# Flog Txt Version 1 # Analyzer Version: 3.1.1 # Analyzer Build Date: Sep 16 2019 10:43:25 # Log Creation Date: 28.09.2019 15:52:09.100 Process: id = "1" image_name = "l25de3a0fbaa3009886613f5e62b92f2.exe" filename = "c:\\users\\fd1hvy\\desktop\\l25de3a0fbaa3009886613f5e62b92f2.exe" page_root = "0xd446000" os_pid = "0xb98" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\l25de3a0fbaa3009886613f5e62b92f2.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x540 [0038.611] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0039.028] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\l25de3a0fbaa3009886613f5e62b92f2.exe", nBufferLength=0x105, lpBuffer=0x8feab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\l25de3a0fbaa3009886613f5e62b92f2.exe", lpFilePart=0x0) returned 0x3c [0039.028] GetLastError () returned 0x2 [0039.035] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\l25de3a0fbaa3009886613f5e62b92f2.exe", nBufferLength=0x105, lpBuffer=0x8fea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\l25de3a0fbaa3009886613f5e62b92f2.exe", lpFilePart=0x0) returned 0x3c [0039.035] GetLastError () returned 0x2 [0039.039] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\", nBufferLength=0x105, lpBuffer=0x8fea14, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\", lpFilePart=0x0) returned 0x18 [0039.039] GetLastError () returned 0x2 [0039.043] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\", nBufferLength=0x105, lpBuffer=0x8feab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\", lpFilePart=0x0) returned 0x18 [0039.043] GetLastError () returned 0x2 [0039.043] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\", nBufferLength=0x105, lpBuffer=0x8fea4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\", lpFilePart=0x0) returned 0x18 [0039.043] GetLastError () returned 0x2 [0039.050] GetVersionExW (in: lpVersionInformation=0x9e8df8*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x9e8df8*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0039.050] GetLastError () returned 0x2 [0039.051] GetVersionExW (in: lpVersionInformation=0x9e8df8*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x9e8df8*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0039.051] GetLastError () returned 0x2 [0040.146] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\assembly\\GAC_MSIL\\System.Windows.Forms\\2.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x8febf0, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\assembly\\GAC_MSIL\\System.Windows.Forms\\2.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x64 [0040.146] GetLastError () returned 0x8013141b [0040.156] IsAppThemed () returned 0x1 [0040.159] CoTaskMemAlloc (cb=0xca) returned 0x9cd1f0 [0040.159] CreateActCtxA (pActCtx=0x9ea1f8) returned 0x9f8cbc [0040.222] CoTaskMemFree (pv=0x9cd1f0) [0040.234] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc151 [0040.234] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc16d [0040.281] GetSystemMetrics (nIndex=75) returned 1 [0040.288] AdjustWindowRectEx (in: lpRect=0x8ff0d0, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x8ff0d0) returned 1 [0040.290] GetCurrentProcess () returned 0xffffffff [0040.290] GetCurrentThread () returned 0xfffffffe [0040.290] GetCurrentProcess () returned 0xffffffff [0040.291] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x8ff000, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x8ff000*=0x2e0) returned 1 [0040.291] GetLastError () returned 0x0 [0040.294] GetCurrentThreadId () returned 0x540 [0040.328] GetCurrentActCtx (in: lphActCtx=0x8fef60 | out: lphActCtx=0x8fef60*=0x0) returned 1 [0040.329] ActivateActCtx (in: hActCtx=0x9f8cbc, lpCookie=0x8fef74 | out: hActCtx=0x9f8cbc, lpCookie=0x8fef74) returned 1 [0040.331] lstrlenW (lpString="䅁") returned 1 [0040.334] GetModuleHandleW (lpModuleName="user32.dll") returned 0x74b70000 [0040.335] GetProcAddress (hModule=0x74b70000, lpProcName="DefWindowProcW") returned 0x77c35690 [0040.336] GetStockObject (i=5) returned 0x900015 [0040.336] GetLastError () returned 0x0 [0040.347] GetModuleHandleW (lpModuleName=0x0) returned 0x550000 [0040.353] CoTaskMemAlloc (cb=0x4c) returned 0x9cfe90 [0040.353] RegisterClassW (lpWndClass=0x9ea210) returned 0xc16c [0040.353] GetLastError () returned 0x2 [0040.353] CoTaskMemFree (pv=0x9cfe90) [0040.353] GetModuleHandleW (lpModuleName=0x0) returned 0x550000 [0040.354] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.378734a", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x550000, lpParam=0x0) returned 0x701dc [0040.359] SetWindowLongW (hWnd=0x701dc, nIndex=-4, dwNewLong=2009290384) returned 39585570 [0040.361] GetWindowLongW (hWnd=0x701dc, nIndex=-4) returned 2009290384 [0040.364] lstrlenW (lpString="䅁") returned 1 [0040.366] GetVersionExW (in: lpVersionInformation=0x9ea230*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x9ea230*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0040.366] GetLastError () returned 0x2 [0040.369] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x8fe5fc | out: phkResult=0x8fe5fc*=0x2dc) returned 0x0 [0040.370] RegQueryValueExW (in: hKey=0x2dc, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x8fe644, lpData=0x0, lpcbData=0x8fe640*=0x0 | out: lpType=0x8fe644*=0x0, lpData=0x0, lpcbData=0x8fe640*=0x0) returned 0x2 [0040.371] RegQueryValueExW (in: hKey=0x2dc, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x8fe644, lpData=0x0, lpcbData=0x8fe640*=0x0 | out: lpType=0x8fe644*=0x0, lpData=0x0, lpcbData=0x8fe640*=0x0) returned 0x2 [0040.371] RegCloseKey (hKey=0x2dc) returned 0x0 [0040.374] SetWindowLongW (hWnd=0x701dc, nIndex=-4, dwNewLong=39585890) returned 2009290384 [0040.374] GetWindowLongW (hWnd=0x701dc, nIndex=-4) returned 39585890 [0040.374] GetWindowLongW (hWnd=0x701dc, nIndex=-16) returned 113311744 [0040.375] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc16f [0040.377] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x701dc, Msg=0x24, wParam=0x0, lParam=0x8fe95c) returned 0x0 [0040.377] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc170 [0040.377] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x701dc, Msg=0x81, wParam=0x0, lParam=0x8fe950) returned 0x1 [0040.378] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x701dc, Msg=0x83, wParam=0x0, lParam=0x8fe93c) returned 0x0 [0040.618] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x701dc, Msg=0x1, wParam=0x0, lParam=0x8fe950) returned 0x0 [0040.620] GetClientRect (in: hWnd=0x701dc, lpRect=0x8fe64c | out: lpRect=0x8fe64c) returned 1 [0040.621] GetWindowRect (in: hWnd=0x701dc, lpRect=0x8fe64c | out: lpRect=0x8fe64c) returned 1 [0040.623] GetLastError () returned 0x6 [0040.624] GetParent (hWnd=0x701dc) returned 0x0 [0040.625] DeactivateActCtx (dwFlags=0x0, ulCookie=0x16b10001) returned 1 [0041.062] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\l25de3a0fbaa3009886613f5e62b92f2.config", nBufferLength=0x105, lpBuffer=0x8feb40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\l25de3a0fbaa3009886613f5e62b92f2.config", lpFilePart=0x0) returned 0x3f [0041.062] GetLastError () returned 0x0 [0041.062] SetErrorMode (uMode=0x1) returned 0x0 [0041.063] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\l25de3a0fbaa3009886613f5e62b92f2.config" (normalized: "c:\\users\\fd1hvy\\desktop\\l25de3a0fbaa3009886613f5e62b92f2.config"), fInfoLevelId=0x0, lpFileInformation=0x8fefe8 | out: lpFileInformation=0x8fefe8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0041.064] GetLastError () returned 0x2 [0041.064] SetErrorMode (uMode=0x0) returned 0x1 [0042.028] GetCurrentProcessId () returned 0xb98 [0042.028] GetLastError () returned 0x57 [0042.031] FindAtomW (lpString="GDI+Atom_2968_1") returned 0x0 [0042.031] GetLastError () returned 0x2 [0042.031] AddAtomW (lpString="GDI+Atom_2968_1") returned 0xc000 [0042.031] GetLastError () returned 0x2 [0042.447] GdiplusStartup (in: token=0xbd3f14, input=0x9ea1f8, output=0x8fe230 | out: token=0xbd3f14, output=0x8fe230) returned 0x0 [0042.453] GetLastError () returned 0x0 [0042.465] GdipLoadImageFromStream (stream=0x4c60030, image=0x8fea2c) returned 0x0 [0042.755] GetLastError () returned 0x0 [0042.756] GdipImageForceValidation (image=0x4d41f08) returned 0x0 [0042.769] GetLastError () returned 0x0 [0042.769] GdipGetImageType (image=0x4d41f08, type=0x8fea28) returned 0x0 [0042.769] GetLastError () returned 0x0 [0042.770] GdipGetImageRawFormat (image=0x4d41f08, format=0x8fe994*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0042.770] GetLastError () returned 0x0 [0042.797] AdjustWindowRectEx (in: lpRect=0x8ff0a4, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x8ff0a4) returned 1 [0042.797] GetSystemMetrics (nIndex=59) returned 1460 [0042.797] GetSystemMetrics (nIndex=60) returned 920 [0042.798] GetSystemMetrics (nIndex=34) returned 136 [0042.798] GetSystemMetrics (nIndex=35) returned 39 [0042.798] AdjustWindowRectEx (in: lpRect=0x8fefa8, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x8fefa8) returned 1 [0042.804] AdjustWindowRectEx (in: lpRect=0x8fefc4, dwStyle=0x2830000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0x8fefc4) returned 1 [0042.805] AdjustWindowRectEx (in: lpRect=0x8ff07c, dwStyle=0x2830000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0x8ff07c) returned 1 [0042.805] GetSystemMetrics (nIndex=59) returned 1460 [0042.805] GetSystemMetrics (nIndex=60) returned 920 [0042.805] AdjustWindowRectEx (in: lpRect=0x8feed0, dwStyle=0x2830000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0x8feed0) returned 1 [0042.805] AdjustWindowRectEx (in: lpRect=0x8fef80, dwStyle=0x2830000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0x8fef80) returned 1 [0042.806] CreateCompatibleDC (hdc=0x0) returned 0x1c01072d [0042.806] GetLastError () returned 0x0 [0042.807] GetSystemDefaultLCID () returned 0x409 [0042.807] GetLastError () returned 0x0 [0042.808] GetStockObject (i=17) returned 0xa01c1 [0042.808] GetLastError () returned 0x0 [0042.810] GetObjectW (in: h=0xa01c1, c=92, pv=0x9ea210 | out: pv=0x9ea210) returned 92 [0042.810] GetLastError () returned 0x0 [0042.811] GetDC (hWnd=0x0) returned 0x60100ce [0042.811] GetLastError () returned 0x0 [0042.814] GdipCreateFontFromLogfontW (hdc=0x60100ce, logfont=0x9ea210, font=0x8feee4) returned 0x0 [0043.487] GetLastError () returned 0x7a [0043.489] GdipGetFontUnit (font=0x4d42be8, unit=0x8feea8) returned 0x0 [0043.489] GetLastError () returned 0x7f [0043.489] GdipGetFontSize (font=0x4d42be8, size=0x8feeac) returned 0x0 [0043.489] GetLastError () returned 0x7f [0043.489] GdipGetFontStyle (font=0x4d42be8, style=0x8feea4) returned 0x0 [0043.489] GetLastError () returned 0x7f [0043.489] GdipGetFamily (font=0x4d42be8, family=0x8feea0) returned 0x0 [0043.489] GetLastError () returned 0x7f [0043.489] GdipGetFontSize (font=0x4d42be8, size=0x2a54a4c) returned 0x0 [0043.489] GetLastError () returned 0x7f [0043.490] ReleaseDC (hWnd=0x0, hDC=0x60100ce) returned 1 [0043.490] GetLastError () returned 0x7f [0043.490] GetDC (hWnd=0x0) returned 0x60100ce [0043.490] GetLastError () returned 0x7f [0043.491] GdipCreateFromHDC (hdc=0x60100ce, graphics=0x8feedc) returned 0x0 [0043.493] GetLastError () returned 0x7f [0043.494] GdipGetDpiY (graphics=0x60c0038, dpi=0x2a54b54) returned 0x0 [0043.494] GetLastError () returned 0x7f [0043.495] GdipGetFontHeight (font=0x4d42be8, graphics=0x60c0038, height=0x8feed4) returned 0x0 [0043.495] GetLastError () returned 0x7f [0043.495] GdipGetEmHeight (family=0x4d48fa8, style=0, EmHeight=0x8feedc) returned 0x0 [0043.495] GetLastError () returned 0x7f [0043.496] GdipGetLineSpacing (family=0x4d48fa8, style=0, LineSpacing=0x8feedc) returned 0x0 [0043.496] GetLastError () returned 0x7f [0043.496] FindAtomW (lpString="GDI+Atom_2968_1") returned 0xc000 [0043.496] GetLastError () returned 0x7f [0043.496] GdipDeleteGraphics (graphics=0x60c0038) returned 0x0 [0043.496] GetLastError () returned 0x7f [0043.496] ReleaseDC (hWnd=0x0, hDC=0x60100ce) returned 1 [0043.497] GetLastError () returned 0x7f [0043.498] GdipCreateFont (fontFamily=0x4d48fa8, emSize=0x41040000, style=0, unit=0x3, font=0x2a54b14) returned 0x0 [0043.498] GetLastError () returned 0x7f [0043.498] GdipGetFontSize (font=0x4d4e3c8, size=0x2a54b18) returned 0x0 [0043.498] GetLastError () returned 0x7f [0043.498] FindAtomW (lpString="GDI+Atom_2968_1") returned 0xc000 [0043.498] GetLastError () returned 0x7f [0043.498] GdipDeleteFont (font=0x4d42be8) returned 0x0 [0043.498] GetLastError () returned 0x7f [0043.498] GetDC (hWnd=0x0) returned 0x60100ce [0043.498] GetLastError () returned 0x7f [0043.498] GdipCreateFromHDC (hdc=0x60100ce, graphics=0x8fef0c) returned 0x0 [0043.498] GetLastError () returned 0x7f [0043.500] GdipGetLogFontW (font=0x4d4e3c8, graphics=0x60c0038, logfontW=0x9ea210) returned 0x0 [0043.503] GetLastError () returned 0x7f [0043.504] FindAtomW (lpString="GDI+Atom_2968_1") returned 0xc000 [0043.504] GetLastError () returned 0x7f [0043.504] GdipDeleteGraphics (graphics=0x60c0038) returned 0x0 [0043.504] GetLastError () returned 0x7f [0043.504] ReleaseDC (hWnd=0x0, hDC=0x60100ce) returned 1 [0043.504] GetLastError () returned 0x7f [0043.505] CreateFontIndirectW (lplf=0x9ea210) returned 0x380a060b [0043.505] GetLastError () returned 0x7f [0043.505] SelectObject (hdc=0x1c01072d, h=0x380a060b) returned 0x8a01c2 [0043.505] GetLastError () returned 0x7f [0043.506] GetTextMetricsW (in: hdc=0x1c01072d, lptm=0x8feff8 | out: lptm=0x8feff8) returned 1 [0043.519] GetLastError () returned 0x7f [0043.520] GetTextExtentPoint32W (in: hdc=0x1c01072d, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x2a54d7c | out: psizl=0x2a54d7c) returned 1 [0043.522] GetLastError () returned 0x0 [0043.522] SelectObject (hdc=0x1c01072d, h=0x8a01c2) returned 0x380a060b [0043.522] GetLastError () returned 0x0 [0043.523] DeleteDC (hdc=0x1c01072d) returned 1 [0043.523] GetLastError () returned 0x0 [0043.523] AdjustWindowRectEx (in: lpRect=0x8fee18, dwStyle=0x2c30000, bMenu=0, dwExStyle=0x10080 | out: lpRect=0x8fee18) returned 1 [0043.523] AdjustWindowRectEx (in: lpRect=0x8fef8c, dwStyle=0x2c30000, bMenu=0, dwExStyle=0x10080 | out: lpRect=0x8fef8c) returned 1 [0043.523] AdjustWindowRectEx (in: lpRect=0x8fed84, dwStyle=0x2c30000, bMenu=0, dwExStyle=0x10080 | out: lpRect=0x8fed84) returned 1 [0043.523] AdjustWindowRectEx (in: lpRect=0x8fee58, dwStyle=0x2c30000, bMenu=0, dwExStyle=0x10080 | out: lpRect=0x8fee58) returned 1 [0043.525] GetCurrentActCtx (in: lphActCtx=0x8ff0f4 | out: lphActCtx=0x8ff0f4*=0x0) returned 1 [0043.525] ActivateActCtx (in: hActCtx=0x9f8cbc, lpCookie=0x8ff108 | out: hActCtx=0x9f8cbc, lpCookie=0x8ff108) returned 1 [0043.525] GetCurrentActCtx (in: lphActCtx=0x8fef34 | out: lphActCtx=0x8fef34*=0x9f8cbc) returned 1 [0043.525] AdjustWindowRectEx (in: lpRect=0x8feea8, dwStyle=0x2c30000, bMenu=0, dwExStyle=0x10080 | out: lpRect=0x8feea8) returned 1 [0043.525] GetModuleHandleW (lpModuleName=0x0) returned 0x550000 [0043.525] CreateWindowExW (dwExStyle=0x10080, lpClassName="WindowsForms10.Window.8.app.0.378734a", lpWindowName="Bricked Alert!", dwStyle=0x2c30000, X=-2147483648, Y=-2147483648, nWidth=798, nHeight=250, hWndParent=0x0, hMenu=0x0, hInstance=0x550000, lpParam=0x0) returned 0x7002e [0043.525] SetWindowLongW (hWnd=0x7002e, nIndex=-4, dwNewLong=2009290384) returned 39585570 [0043.525] GetWindowLongW (hWnd=0x7002e, nIndex=-4) returned 2009290384 [0043.526] SetWindowLongW (hWnd=0x7002e, nIndex=-4, dwNewLong=39587314) returned 2009290384 [0043.526] GetWindowLongW (hWnd=0x7002e, nIndex=-4) returned 39587314 [0043.526] GetWindowLongW (hWnd=0x7002e, nIndex=-16) returned 113442816 [0043.526] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x81, wParam=0x0, lParam=0x8fe928) returned 0x1 [0043.529] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x83, wParam=0x0, lParam=0x8fe914) returned 0x0 [0043.530] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1, wParam=0x0, lParam=0x8fe928) returned 0x0 [0043.530] GetClientRect (in: hWnd=0x7002e, lpRect=0x8fe5ec | out: lpRect=0x8fe5ec) returned 1 [0043.530] GetWindowRect (in: hWnd=0x7002e, lpRect=0x8fe5ec | out: lpRect=0x8fe5ec) returned 1 [0043.532] SetWindowTextW (hWnd=0x7002e, lpString="Bricked Alert!") returned 1 [0043.532] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xc, wParam=0x0, lParam=0x2a18200) returned 0x1 [0043.537] GetProcessWindowStation () returned 0x13c [0043.538] GetUserObjectInformationA (in: hObj=0x13c, nIndex=1, pvInfo=0x2a5540c, nLength=0xc, lpnLengthNeeded=0x8fe4ec | out: pvInfo=0x2a5540c, lpnLengthNeeded=0x8fe4ec) returned 1 [0043.538] GetLastError () returned 0x0 [0043.542] SetConsoleCtrlHandler (HandlerRoutine=0x25c0f2a, Add=1) returned 1 [0043.542] GetModuleHandleW (lpModuleName=0x0) returned 0x550000 [0043.542] GetModuleHandleW (lpModuleName=0x0) returned 0x550000 [0043.545] GetClassInfoW (in: hInstance=0x550000, lpClassName=".NET-BroadcastEventWindow.2.0.0.0.378734a.0", lpWndClass=0x2a55454 | out: lpWndClass=0x2a55454) returned 0 [0043.548] CoTaskMemAlloc (cb=0x58) returned 0x9ff2d8 [0043.548] RegisterClassW (lpWndClass=0x9ea230) returned 0xc172 [0043.548] GetLastError () returned 0x583 [0043.548] CoTaskMemFree (pv=0x9ff2d8) [0043.549] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.2.0.0.0.378734a.0", lpWindowName=".NET-BroadcastEventWindow.2.0.0.0.378734a.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x550000, lpParam=0x0) returned 0x60044 [0043.550] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x81, wParam=0x0, lParam=0x8fdf60) returned 0x1 [0043.581] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x83, wParam=0x0, lParam=0x8fdf4c) returned 0x0 [0043.581] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x1, wParam=0x0, lParam=0x8fdf60) returned 0x0 [0043.582] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0043.582] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0043.585] GetLastError () returned 0x7f [0043.604] GetStartupInfoW (in: lpStartupInfo=0x2a55b98 | out: lpStartupInfo=0x2a55b98*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\l25de3a0fbaa3009886613f5e62b92f2.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0043.628] GetLastError () returned 0x7f [0043.628] GetParent (hWnd=0x7002e) returned 0x0 [0043.629] GetStockObject (i=5) returned 0x900015 [0043.629] GetLastError () returned 0x7f [0043.630] GetModuleHandleW (lpModuleName=0x0) returned 0x550000 [0043.630] CoTaskMemAlloc (cb=0x4c) returned 0x9cfee8 [0043.630] RegisterClassW (lpWndClass=0x9ea210) returned 0xc173 [0043.630] GetLastError () returned 0x7f [0043.630] CoTaskMemFree (pv=0x9cfee8) [0043.631] GetModuleHandleW (lpModuleName=0x0) returned 0x550000 [0043.631] CreateWindowExW (dwExStyle=0x80, lpClassName="WindowsForms10.Window.0.app.0.378734a", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x550000, lpParam=0x0) returned 0x4020e [0043.631] SetWindowLongW (hWnd=0x4020e, nIndex=-4, dwNewLong=2009290384) returned 39587722 [0043.631] GetWindowLongW (hWnd=0x4020e, nIndex=-4) returned 2009290384 [0043.632] SetWindowLongW (hWnd=0x4020e, nIndex=-4, dwNewLong=39587770) returned 2009290384 [0043.632] GetWindowLongW (hWnd=0x4020e, nIndex=-4) returned 39587770 [0043.632] GetWindowLongW (hWnd=0x4020e, nIndex=-16) returned 79691776 [0043.633] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x24, wParam=0x0, lParam=0x8fe95c) returned 0x0 [0043.633] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x81, wParam=0x0, lParam=0x8fe950) returned 0x1 [0043.633] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x83, wParam=0x0, lParam=0x8fe93c) returned 0x0 [0043.634] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x1, wParam=0x0, lParam=0x8fe950) returned 0x0 [0043.635] GetLastError () returned 0x0 [0043.635] SetWindowLongW (hWnd=0x7002e, nIndex=-8, dwNewLong=262670) returned 0 [0043.638] GetSystemMetrics (nIndex=11) returned 32 [0043.638] GetLastError () returned 0x0 [0043.638] GetSystemMetrics (nIndex=12) returned 32 [0043.638] GetLastError () returned 0x0 [0043.638] GetDC (hWnd=0x0) returned 0x60100ce [0043.638] GetLastError () returned 0x0 [0043.639] GetDeviceCaps (hdc=0x60100ce, index=12) returned 32 [0043.639] GetLastError () returned 0x0 [0043.639] GetDeviceCaps (hdc=0x60100ce, index=14) returned 1 [0043.639] GetLastError () returned 0x0 [0043.639] ReleaseDC (hWnd=0x0, hDC=0x60100ce) returned 1 [0043.639] GetLastError () returned 0x0 [0043.640] CreateIconFromResourceEx (presbits=0x2a587a8, dwResSize=0x10a8, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x9021f [0043.641] GetLastError () returned 0x0 [0043.641] GetSystemMetrics (nIndex=49) returned 16 [0043.641] GetSystemMetrics (nIndex=50) returned 16 [0043.642] CreateIconFromResourceEx (presbits=0x2a59884, dwResSize=0x468, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0xa008f [0043.642] GetLastError () returned 0x0 [0043.643] SendMessageW (hWnd=0x7002e, Msg=0x80, wParam=0x0, lParam=0xa008f) returned 0x0 [0043.643] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x80, wParam=0x0, lParam=0xa008f) returned 0x0 [0043.643] SendMessageW (hWnd=0x7002e, Msg=0x80, wParam=0x1, lParam=0x9021f) returned 0x0 [0043.643] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x80, wParam=0x1, lParam=0x9021f) returned 0x0 [0043.644] GetSystemMenu (hWnd=0x7002e, bRevert=0) returned 0x0 [0043.644] GetWindowPlacement (in: hWnd=0x7002e, lpwndpl=0x8fef44 | out: lpwndpl=0x8fef44) returned 1 [0043.645] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x0) returned 1 [0043.645] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf030, uEnable=0x0) returned 1 [0043.645] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf060, uEnable=0x1) returned 1 [0043.645] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0043.645] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf000, uEnable=0x1) returned 1 [0043.645] GetClientRect (in: hWnd=0x7002e, lpRect=0x8fef84 | out: lpRect=0x8fef84) returned 1 [0043.645] GetClientRect (in: hWnd=0x7002e, lpRect=0x8fef38 | out: lpRect=0x8fef38) returned 1 [0043.645] GetWindowRect (in: hWnd=0x7002e, lpRect=0x8fef38 | out: lpRect=0x8fef38) returned 1 [0043.645] SetWindowLongW (hWnd=0x7002e, nIndex=-8, dwNewLong=262670) returned 262670 [0043.647] SendMessageW (hWnd=0x4020e, Msg=0x80, wParam=0x1, lParam=0x9021f) returned 0x0 [0043.647] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x80, wParam=0x1, lParam=0x9021f) returned 0x0 [0043.651] SetWindowPos (hWnd=0x7002e, hWndInsertAfter=0xffffffff, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0043.651] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fef04) returned 0x0 [0043.651] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fef04) returned 0x0 [0043.653] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fef04) returned 0x0 [0043.653] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fef04) returned 0x0 [0043.654] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x47, wParam=0x0, lParam=0x8fef04) returned 0x0 [0043.659] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0043.659] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0043.659] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0043.659] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0043.662] OleInitialize (pvReserved=0x0) returned 0x0 [0043.662] GetLastError () returned 0x0 [0043.663] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0x8fec60 | out: lplpMessageFilter=0x8fec60*=0x0) returned 0x0 [0043.702] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0043.709] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0043.709] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0043.710] GetParent (hWnd=0x7002e) returned 0x0 [0043.710] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0043.710] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0043.710] GetWindowLongW (hWnd=0x7002e, nIndex=-16) returned 113442816 [0043.711] GetWindowTextLengthW (hWnd=0x7002e) returned 14 [0043.711] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xe [0043.711] GetSystemMetrics (nIndex=42) returned 0 [0043.711] GetWindowTextW (in: hWnd=0x7002e, lpString=0x9ea1f8, nMaxCount=15 | out: lpString="Bricked Alert!") returned 14 [0043.711] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xd, wParam=0xf, lParam=0x9ea1f8) returned 0xe [0043.712] GetWindowTextLengthW (hWnd=0x7002e) returned 14 [0043.712] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xe [0043.712] GetSystemMetrics (nIndex=42) returned 0 [0043.712] GetWindowTextW (in: hWnd=0x7002e, lpString=0x9ea1f8, nMaxCount=15 | out: lpString="Bricked Alert!") returned 14 [0043.712] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xd, wParam=0xf, lParam=0x9ea1f8) returned 0xe [0043.712] GetWindowLongW (hWnd=0x7002e, nIndex=-16) returned 113442816 [0043.712] GetWindowLongW (hWnd=0x7002e, nIndex=-20) returned 65920 [0043.712] SetWindowLongW (hWnd=0x7002e, nIndex=-16, dwNewLong=46333952) returned 113442816 [0043.712] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7c, wParam=0xfffffff0, lParam=0x8feec4) returned 0x0 [0043.712] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7d, wParam=0xfffffff0, lParam=0x8feec4) returned 0x0 [0043.715] SetWindowLongW (hWnd=0x7002e, nIndex=-20, dwNewLong=65664) returned 65920 [0043.715] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7c, wParam=0xffffffec, lParam=0x8feec4) returned 0x0 [0043.716] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7d, wParam=0xffffffec, lParam=0x8feec4) returned 0x0 [0043.716] SetWindowPos (hWnd=0x7002e, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0043.716] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8feef4) returned 0x0 [0043.716] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x83, wParam=0x1, lParam=0x8feecc) returned 0x0 [0043.717] GetWindowPlacement (in: hWnd=0x7002e, lpwndpl=0x8fec30 | out: lpwndpl=0x8fec30) returned 1 [0043.718] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x47, wParam=0x0, lParam=0x8feef4) returned 0x0 [0043.718] GetClientRect (in: hWnd=0x7002e, lpRect=0x8febcc | out: lpRect=0x8febcc) returned 1 [0043.718] GetWindowRect (in: hWnd=0x7002e, lpRect=0x8febcc | out: lpRect=0x8febcc) returned 1 [0043.719] RedrawWindow (hWnd=0x7002e, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0043.719] GetSystemMenu (hWnd=0x7002e, bRevert=0) returned 0x0 [0043.719] GetWindowPlacement (in: hWnd=0x7002e, lpwndpl=0x8fef28 | out: lpwndpl=0x8fef28) returned 1 [0043.719] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x0) returned 1 [0043.719] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf030, uEnable=0x0) returned 1 [0043.719] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf060, uEnable=0x1) returned 1 [0043.719] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0043.719] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf000, uEnable=0x1) returned 1 [0043.720] ShowWindow (hWnd=0x7002e, nCmdShow=5) [0043.720] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0043.720] GetWindowTextLengthW (hWnd=0x7002e) returned 14 [0043.720] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xe [0043.720] GetSystemMetrics (nIndex=42) returned 0 [0043.720] GetWindowTextW (in: hWnd=0x7002e, lpString=0x9ea1f8, nMaxCount=15 | out: lpString="Bricked Alert!") returned 14 [0043.721] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xd, wParam=0xf, lParam=0x9ea1f8) returned 0xe [0043.974] CoCreateGuid (in: pguid=0x8fea48 | out: pguid=0x8fea48*(Data1=0xec3b99e9, Data2=0x5870, Data3=0x4f5f, Data4=([0]=0xa8, [1]=0x89, [2]=0x2a, [3]=0xd1, [4]=0xf0, [5]=0x2d, [6]=0x7, [7]=0xe2))) returned 0x0 [0043.975] GetVersionExW (in: lpVersionInformation=0x9ea210*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x9ea210*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0043.975] GetLastError () returned 0x579 [0044.385] CryptAcquireContextW (in: phProv=0x8feacc, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x8feacc*=0x9e9e10) returned 1 [0044.385] GetLastError () returned 0x0 [0044.399] CryptGetProvParam (in: hProv=0x9e9e10, dwParam=0x1, pbData=0x0, pdwDataLen=0x8fea8c, dwFlags=0x1 | out: pbData=0x0, pdwDataLen=0x8fea8c) returned 1 [0044.399] GetLastError () returned 0x0 [0044.400] CoTaskMemAlloc (cb=0x20) returned 0xa1d3d0 [0044.400] CryptGetProvParam (in: hProv=0x9e9e10, dwParam=0x1, pbData=0xa1d3d0, pdwDataLen=0x8fea8c, dwFlags=0x1 | out: pbData=0xa1d3d0, pdwDataLen=0x8fea8c) returned 1 [0044.400] GetLastError () returned 0x0 [0044.403] CoTaskMemFree (pv=0xa1d3d0) [0044.403] CryptGetProvParam (in: hProv=0x9e9e10, dwParam=0x1, pbData=0x0, pdwDataLen=0x8fea8c, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x8fea8c) returned 1 [0044.403] GetLastError () returned 0x0 [0044.403] CoTaskMemAlloc (cb=0x20) returned 0xa1d308 [0044.403] CryptGetProvParam (in: hProv=0x9e9e10, dwParam=0x1, pbData=0xa1d308, pdwDataLen=0x8fea8c, dwFlags=0x0 | out: pbData=0xa1d308, pdwDataLen=0x8fea8c) returned 1 [0044.404] GetLastError () returned 0x0 [0044.404] CoTaskMemFree (pv=0xa1d308) [0044.404] CryptGetProvParam (in: hProv=0x9e9e10, dwParam=0x1, pbData=0x0, pdwDataLen=0x8fea8c, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x8fea8c) returned 1 [0044.404] GetLastError () returned 0x0 [0044.404] CoTaskMemAlloc (cb=0x20) returned 0xa1d1f0 [0044.404] CryptGetProvParam (in: hProv=0x9e9e10, dwParam=0x1, pbData=0xa1d1f0, pdwDataLen=0x8fea8c, dwFlags=0x0 | out: pbData=0xa1d1f0, pdwDataLen=0x8fea8c) returned 1 [0044.404] GetLastError () returned 0x0 [0044.404] CoTaskMemFree (pv=0xa1d1f0) [0044.404] CryptGetProvParam (in: hProv=0x9e9e10, dwParam=0x1, pbData=0x0, pdwDataLen=0x8fea8c, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x8fea8c) returned 1 [0044.404] GetLastError () returned 0x0 [0044.404] CoTaskMemAlloc (cb=0x20) returned 0xa1d330 [0044.404] CryptGetProvParam (in: hProv=0x9e9e10, dwParam=0x1, pbData=0xa1d330, pdwDataLen=0x8fea8c, dwFlags=0x0 | out: pbData=0xa1d330, pdwDataLen=0x8fea8c) returned 1 [0044.404] GetLastError () returned 0x0 [0044.404] CoTaskMemFree (pv=0xa1d330) [0044.404] CryptGetProvParam (in: hProv=0x9e9e10, dwParam=0x1, pbData=0x0, pdwDataLen=0x8fea8c, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x8fea8c) returned 1 [0044.404] GetLastError () returned 0x0 [0044.404] CoTaskMemAlloc (cb=0x20) returned 0xa1d308 [0044.404] CryptGetProvParam (in: hProv=0x9e9e10, dwParam=0x1, pbData=0xa1d308, pdwDataLen=0x8fea8c, dwFlags=0x0 | out: pbData=0xa1d308, pdwDataLen=0x8fea8c) returned 1 [0044.404] GetLastError () returned 0x0 [0044.404] CoTaskMemFree (pv=0xa1d308) [0044.404] CryptGetProvParam (in: hProv=0x9e9e10, dwParam=0x1, pbData=0x0, pdwDataLen=0x8fea8c, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x8fea8c) returned 1 [0044.404] GetLastError () returned 0x0 [0044.404] CoTaskMemAlloc (cb=0x20) returned 0xa1d1f0 [0044.404] CryptGetProvParam (in: hProv=0x9e9e10, dwParam=0x1, pbData=0xa1d1f0, pdwDataLen=0x8fea8c, dwFlags=0x0 | out: pbData=0xa1d1f0, pdwDataLen=0x8fea8c) returned 1 [0044.404] GetLastError () returned 0x0 [0044.404] CoTaskMemFree (pv=0xa1d1f0) [0044.405] CryptGetProvParam (in: hProv=0x9e9e10, dwParam=0x1, pbData=0x0, pdwDataLen=0x8fea8c, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x8fea8c) returned 1 [0044.405] GetLastError () returned 0x0 [0044.405] CoTaskMemAlloc (cb=0x20) returned 0xa1d268 [0044.405] CryptGetProvParam (in: hProv=0x9e9e10, dwParam=0x1, pbData=0xa1d268, pdwDataLen=0x8fea8c, dwFlags=0x0 | out: pbData=0xa1d268, pdwDataLen=0x8fea8c) returned 1 [0044.405] GetLastError () returned 0x0 [0044.405] CoTaskMemFree (pv=0xa1d268) [0044.405] CryptGetProvParam (in: hProv=0x9e9e10, dwParam=0x1, pbData=0x0, pdwDataLen=0x8fea8c, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x8fea8c) returned 1 [0044.405] GetLastError () returned 0x0 [0044.405] CoTaskMemAlloc (cb=0x20) returned 0xa1d150 [0044.405] CryptGetProvParam (in: hProv=0x9e9e10, dwParam=0x1, pbData=0xa1d150, pdwDataLen=0x8fea8c, dwFlags=0x0 | out: pbData=0xa1d150, pdwDataLen=0x8fea8c) returned 1 [0044.405] GetLastError () returned 0x0 [0044.405] CoTaskMemFree (pv=0xa1d150) [0044.405] CryptGetProvParam (in: hProv=0x9e9e10, dwParam=0x1, pbData=0x0, pdwDataLen=0x8fea8c, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x8fea8c) returned 1 [0044.405] GetLastError () returned 0x0 [0044.405] CoTaskMemAlloc (cb=0x20) returned 0xa1d358 [0044.405] CryptGetProvParam (in: hProv=0x9e9e10, dwParam=0x1, pbData=0xa1d358, pdwDataLen=0x8fea8c, dwFlags=0x0 | out: pbData=0xa1d358, pdwDataLen=0x8fea8c) returned 1 [0044.405] GetLastError () returned 0x0 [0044.405] CoTaskMemFree (pv=0xa1d358) [0044.405] CryptGetProvParam (in: hProv=0x9e9e10, dwParam=0x1, pbData=0x0, pdwDataLen=0x8fea8c, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x8fea8c) returned 1 [0044.405] GetLastError () returned 0x0 [0044.405] CoTaskMemAlloc (cb=0x20) returned 0xa1d308 [0044.405] CryptGetProvParam (in: hProv=0x9e9e10, dwParam=0x1, pbData=0xa1d308, pdwDataLen=0x8fea8c, dwFlags=0x0 | out: pbData=0xa1d308, pdwDataLen=0x8fea8c) returned 1 [0044.405] GetLastError () returned 0x0 [0044.405] CoTaskMemFree (pv=0xa1d308) [0044.405] CryptGetProvParam (in: hProv=0x9e9e10, dwParam=0x1, pbData=0x0, pdwDataLen=0x8fea8c, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x8fea8c) returned 1 [0044.405] GetLastError () returned 0x0 [0044.405] CoTaskMemAlloc (cb=0x20) returned 0xa1d1f0 [0044.406] CryptGetProvParam (in: hProv=0x9e9e10, dwParam=0x1, pbData=0xa1d1f0, pdwDataLen=0x8fea8c, dwFlags=0x0 | out: pbData=0xa1d1f0, pdwDataLen=0x8fea8c) returned 1 [0044.406] GetLastError () returned 0x0 [0044.406] CoTaskMemFree (pv=0xa1d1f0) [0044.406] CryptGetProvParam (in: hProv=0x9e9e10, dwParam=0x1, pbData=0x0, pdwDataLen=0x8fea8c, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x8fea8c) returned 1 [0044.406] GetLastError () returned 0x0 [0044.406] CoTaskMemAlloc (cb=0x20) returned 0xa1d3d0 [0044.406] CryptGetProvParam (in: hProv=0x9e9e10, dwParam=0x1, pbData=0xa1d3d0, pdwDataLen=0x8fea8c, dwFlags=0x0 | out: pbData=0xa1d3d0, pdwDataLen=0x8fea8c) returned 1 [0044.406] GetLastError () returned 0x0 [0044.406] CoTaskMemFree (pv=0xa1d3d0) [0044.406] CryptGetProvParam (in: hProv=0x9e9e10, dwParam=0x1, pbData=0x0, pdwDataLen=0x8fea8c, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x8fea8c) returned 1 [0044.406] GetLastError () returned 0x0 [0044.406] CoTaskMemAlloc (cb=0x20) returned 0xa1d1f0 [0044.406] CryptGetProvParam (in: hProv=0x9e9e10, dwParam=0x1, pbData=0xa1d1f0, pdwDataLen=0x8fea8c, dwFlags=0x0 | out: pbData=0xa1d1f0, pdwDataLen=0x8fea8c) returned 1 [0044.406] GetLastError () returned 0x0 [0044.406] CoTaskMemFree (pv=0xa1d1f0) [0044.406] CryptGetProvParam (in: hProv=0x9e9e10, dwParam=0x1, pbData=0x0, pdwDataLen=0x8fea8c, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x8fea8c) returned 1 [0044.406] GetLastError () returned 0x0 [0044.406] CoTaskMemAlloc (cb=0x20) returned 0xa1d268 [0044.406] CryptGetProvParam (in: hProv=0x9e9e10, dwParam=0x1, pbData=0xa1d268, pdwDataLen=0x8fea8c, dwFlags=0x0 | out: pbData=0xa1d268, pdwDataLen=0x8fea8c) returned 1 [0044.406] GetLastError () returned 0x0 [0044.406] CoTaskMemFree (pv=0xa1d268) [0044.406] CryptGetProvParam (in: hProv=0x9e9e10, dwParam=0x1, pbData=0x0, pdwDataLen=0x8fea8c, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x8fea8c) returned 1 [0044.406] GetLastError () returned 0x0 [0044.406] CoTaskMemAlloc (cb=0x20) returned 0xa1d308 [0044.406] CryptGetProvParam (in: hProv=0x9e9e10, dwParam=0x1, pbData=0xa1d308, pdwDataLen=0x8fea8c, dwFlags=0x0 | out: pbData=0xa1d308, pdwDataLen=0x8fea8c) returned 1 [0044.406] GetLastError () returned 0x0 [0044.406] CoTaskMemFree (pv=0xa1d308) [0044.407] CryptGetProvParam (in: hProv=0x9e9e10, dwParam=0x1, pbData=0x0, pdwDataLen=0x8fea8c, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x8fea8c) returned 1 [0044.407] GetLastError () returned 0x0 [0044.407] CoTaskMemAlloc (cb=0x20) returned 0xa1d330 [0044.407] CryptGetProvParam (in: hProv=0x9e9e10, dwParam=0x1, pbData=0xa1d330, pdwDataLen=0x8fea8c, dwFlags=0x0 | out: pbData=0xa1d330, pdwDataLen=0x8fea8c) returned 1 [0044.407] GetLastError () returned 0x0 [0044.407] CoTaskMemFree (pv=0xa1d330) [0044.407] CryptGetProvParam (in: hProv=0x9e9e10, dwParam=0x1, pbData=0x0, pdwDataLen=0x8fea8c, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x8fea8c) returned 1 [0044.407] GetLastError () returned 0x0 [0044.407] CoTaskMemAlloc (cb=0x20) returned 0xa1d308 [0044.407] CryptGetProvParam (in: hProv=0x9e9e10, dwParam=0x1, pbData=0xa1d308, pdwDataLen=0x8fea8c, dwFlags=0x0 | out: pbData=0xa1d308, pdwDataLen=0x8fea8c) returned 1 [0044.407] GetLastError () returned 0x0 [0044.407] CoTaskMemFree (pv=0xa1d308) [0044.407] CryptGetProvParam (in: hProv=0x9e9e10, dwParam=0x1, pbData=0x0, pdwDataLen=0x8fea8c, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x8fea8c) returned 1 [0044.407] GetLastError () returned 0x0 [0044.407] CoTaskMemAlloc (cb=0x20) returned 0xa1d3d0 [0044.407] CryptGetProvParam (in: hProv=0x9e9e10, dwParam=0x1, pbData=0xa1d3d0, pdwDataLen=0x8fea8c, dwFlags=0x0 | out: pbData=0xa1d3d0, pdwDataLen=0x8fea8c) returned 1 [0044.407] GetLastError () returned 0x0 [0044.407] CoTaskMemFree (pv=0xa1d3d0) [0044.407] CryptGetProvParam (in: hProv=0x9e9e10, dwParam=0x1, pbData=0x0, pdwDataLen=0x8fea8c, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x8fea8c) returned 1 [0044.407] GetLastError () returned 0x0 [0044.407] CoTaskMemAlloc (cb=0x20) returned 0xa1d268 [0044.407] CryptGetProvParam (in: hProv=0x9e9e10, dwParam=0x1, pbData=0xa1d268, pdwDataLen=0x8fea8c, dwFlags=0x0 | out: pbData=0xa1d268, pdwDataLen=0x8fea8c) returned 1 [0044.407] GetLastError () returned 0x0 [0044.407] CoTaskMemFree (pv=0xa1d268) [0044.407] CryptGetProvParam (in: hProv=0x9e9e10, dwParam=0x1, pbData=0x0, pdwDataLen=0x8fea8c, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x8fea8c) returned 1 [0044.407] GetLastError () returned 0x0 [0044.408] CoTaskMemAlloc (cb=0x20) returned 0xa1d268 [0044.408] CryptGetProvParam (in: hProv=0x9e9e10, dwParam=0x1, pbData=0xa1d268, pdwDataLen=0x8fea8c, dwFlags=0x0 | out: pbData=0xa1d268, pdwDataLen=0x8fea8c) returned 1 [0044.408] GetLastError () returned 0x0 [0044.408] CoTaskMemFree (pv=0xa1d268) [0044.408] CryptGetProvParam (in: hProv=0x9e9e10, dwParam=0x1, pbData=0x0, pdwDataLen=0x8fea8c, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x8fea8c) returned 0 [0044.408] GetLastError () returned 0x103 [0044.412] CryptGenKey (in: hProv=0x9e9e10, Algid=0x6610, dwFlags=0x1, phKey=0x8feac8 | out: phKey=0x8feac8*=0x9f5b20) returned 1 [0044.414] GetLastError () returned 0x103 [0044.414] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0044.414] GetLastError () returned 0x103 [0044.417] CryptExportKey (in: hKey=0x9f5b20, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8feb3c | out: pbData=0x0*, pdwDataLen=0x8feb3c*=0x2c) returned 1 [0044.417] GetLastError () returned 0x103 [0044.417] CryptExportKey (in: hKey=0x9f5b20, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x2a5b334, pdwDataLen=0x8feb3c | out: pbData=0x2a5b334*, pdwDataLen=0x8feb3c*=0x2c) returned 1 [0044.417] GetLastError () returned 0x103 [0044.495] CryptExportKey (in: hKey=0x9f5b20, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8feb3c | out: pbData=0x0*, pdwDataLen=0x8feb3c*=0x2c) returned 1 [0044.495] GetLastError () returned 0x103 [0044.495] CryptExportKey (in: hKey=0x9f5b20, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x2a60f9c, pdwDataLen=0x8feb3c | out: pbData=0x2a60f9c*, pdwDataLen=0x8feb3c*=0x2c) returned 1 [0044.495] GetLastError () returned 0x103 [0044.500] GetSystemDirectoryW (in: lpBuffer=0xa21e98, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0044.500] GetLastError () returned 0x103 [0044.500] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x105, lpBuffer=0x8fe624, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x0) returned 0x13 [0044.500] GetLastError () returned 0x103 [0044.500] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x8fe680, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0044.501] GetLastError () returned 0x103 [0044.502] SetErrorMode (uMode=0x1) returned 0x0 [0044.502] GetFileAttributesExW (in: lpFileName="C:\\Users" (normalized: "c:\\users"), fInfoLevelId=0x0, lpFileInformation=0x8feb00 | out: lpFileInformation=0x8feb00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0044.502] GetLastError () returned 0x103 [0044.502] SetErrorMode (uMode=0x0) returned 0x1 [0044.543] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x8fe5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0044.543] GetLastError () returned 0x103 [0044.543] SetErrorMode (uMode=0x1) returned 0x0 [0044.544] FindFirstFileW (in: lpFileName="C:\\Users\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f5f60 [0044.544] GetLastError () returned 0x103 [0044.544] FindNextFileW (in: hFindFile=0x9f5f60, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.545] GetLastError () returned 0x103 [0044.545] FindNextFileW (in: hFindFile=0x9f5f60, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xd7b844b1, ftCreationTime.dwHighDateTime=0x1d2a02f, ftLastAccessTime.dwLowDateTime=0xd7b844b1, ftLastAccessTime.dwHighDateTime=0x1d2a02f, ftLastWriteTime.dwLowDateTime=0xd7b844b1, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0044.545] GetLastError () returned 0x103 [0044.545] FindNextFileW (in: hFindFile=0x9f5f60, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0044.545] GetLastError () returned 0x103 [0044.545] FindNextFileW (in: hFindFile=0x9f5f60, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xd7b844b1, ftCreationTime.dwHighDateTime=0x1d2a02f, ftLastAccessTime.dwLowDateTime=0xd7b844b1, ftLastAccessTime.dwHighDateTime=0x1d2a02f, ftLastWriteTime.dwLowDateTime=0xd7b844b1, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0044.545] GetLastError () returned 0x103 [0044.545] FindNextFileW (in: hFindFile=0x9f5f60, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default.migrated", cAlternateFileName="DEFAUL~1.MIG")) returned 1 [0044.545] GetLastError () returned 0x103 [0044.546] FindNextFileW (in: hFindFile=0x9f5f60, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9bc987, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0044.546] GetLastError () returned 0x103 [0044.546] FindNextFileW (in: hFindFile=0x9f5f60, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 1 [0044.546] GetLastError () returned 0x103 [0044.546] FindNextFileW (in: hFindFile=0x9f5f60, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 1 [0044.546] GetLastError () returned 0x103 [0044.546] FindNextFileW (in: hFindFile=0x9f5f60, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 0 [0044.546] GetLastError () returned 0x12 [0044.547] FindClose (in: hFindFile=0x9f5f60 | out: hFindFile=0x9f5f60) returned 1 [0044.547] SetErrorMode (uMode=0x0) returned 0x1 [0044.664] GetProcessWindowStation () returned 0x13c [0044.666] GetUserObjectInformationA (in: hObj=0x13c, nIndex=1, pvInfo=0x2a64f48, nLength=0xc, lpnLengthNeeded=0x8fea00 | out: pvInfo=0x2a64f48, lpnLengthNeeded=0x8fea00) returned 1 [0044.666] GetLastError () returned 0x12 [0044.667] GetActiveWindow () returned 0x7002e [0044.667] GetCurrentActCtx (in: lphActCtx=0x8fe9f4 | out: lphActCtx=0x8fe9f4*=0x9f8cbc) returned 1 [0044.670] GetCurrentThreadId () returned 0x540 [0044.673] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c0fea, lParam=0x0) returned 1 [0044.676] IsWindowVisible (hWnd=0x60044) returned 0 [0044.676] IsWindowVisible (hWnd=0x7002e) returned 0 [0044.676] IsWindowVisible (hWnd=0x4020e) returned 0 [0044.676] IsWindowVisible (hWnd=0x2021a) returned 0 [0044.677] IsWindowVisible (hWnd=0x8004a) returned 0 [0044.677] GetActiveWindow () returned 0x7002e [0044.678] GetFocus () returned 0x7002e [0044.682] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0044.754] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0044.755] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0044.756] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0044.757] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0044.757] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0044.757] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0045.441] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x3020c) returned 0x1 [0045.444] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe2ac) returned 0x0 [0045.444] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe2ac) returned 0x0 [0045.445] GetWindowPlacement (in: hWnd=0x7002e, lpwndpl=0x8fdfe8 | out: lpwndpl=0x8fdfe8) returned 1 [0045.445] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x47, wParam=0x0, lParam=0x8fe2ac) returned 0x0 [0045.445] GetClientRect (in: hWnd=0x7002e, lpRect=0x8fdf84 | out: lpRect=0x8fdf84) returned 1 [0045.445] GetWindowRect (in: hWnd=0x7002e, lpRect=0x8fdf84 | out: lpRect=0x8fdf84) returned 1 [0045.446] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x47, wParam=0x0, lParam=0x8fe2ac) returned 0x0 [0045.452] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0045.452] lstrlenW (lpString="windows") returned 7 [0045.453] lstrcpyW (in: lpString1=0x9ea1f8, lpString2="windows" | out: lpString1="windows") returned="windows" [0045.454] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0xa1e080 [0045.455] RtlMoveMemory (in: Destination=0xa1e080, Source=0x2a65070, Length=0x10 | out: Destination=0xa1e080) [0045.456] PostMessageW (hWnd=0x60044, Msg=0x201a, wParam=0x0, lParam=0xa1e080) returned 1 [0045.456] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x1a, wParam=0x0, lParam=0x5fd208) returned 0x0 [0045.456] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0045.456] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1a, wParam=0x0, lParam=0x5fd208) returned 0x0 [0045.457] SystemParametersInfoW (in: uiAction=0x26, uiParam=0x0, pvParam=0x8fe350, fWinIni=0x0 | out: pvParam=0x8fe350) returned 1 [0045.458] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x1a, wParam=0x0, lParam=0x5fd208) returned 0x0 [0045.496] lstrlenW (lpString="windows") returned 7 [0045.496] lstrcpyW (in: lpString1=0x9ea1f8, lpString2="windows" | out: lpString1="windows") returned="windows" [0045.496] lstrlenW (lpString="windows") returned 7 [0045.496] lstrcpyW (in: lpString1=0x9ea1f8, lpString2="windows" | out: lpString1="windows") returned="windows" [0045.497] lstrlenW (lpString="windows") returned 7 [0045.497] lstrcpyW (in: lpString1=0x9ea1f8, lpString2="windows" | out: lpString1="windows") returned="windows" [0045.497] lstrlenW (lpString="windows") returned 7 [0045.497] lstrcpyW (in: lpString1=0x9ea1f8, lpString2="windows" | out: lpString1="windows") returned="windows" [0045.507] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\l25de3a0fbaa3009886613f5e62b92f2.exe", nBufferLength=0x105, lpBuffer=0x8fde84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\l25de3a0fbaa3009886613f5e62b92f2.exe", lpFilePart=0x0) returned 0x3c [0045.507] GetLastError () returned 0x0 [0045.507] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\l25de3a0fbaa3009886613f5e62b92f2.exe", nBufferLength=0x105, lpBuffer=0x8fde10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\l25de3a0fbaa3009886613f5e62b92f2.exe", lpFilePart=0x0) returned 0x3c [0045.507] GetLastError () returned 0x0 [0045.508] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\l25de3a0fbaa3009886613f5e62b92f2.exe", nBufferLength=0x105, lpBuffer=0x8fde48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\l25de3a0fbaa3009886613f5e62b92f2.exe", lpFilePart=0x0) returned 0x3c [0045.508] GetLastError () returned 0x0 [0045.508] SetErrorMode (uMode=0x1) returned 0x0 [0045.508] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\l25de3a0fbaa3009886613f5e62b92f2.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\l25de3a0fbaa3009886613f5e62b92f2.exe"), fInfoLevelId=0x0, lpFileInformation=0x8fe2c8 | out: lpFileInformation=0x8fe2c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae1f2d80, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xae1f2d80, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xac556a00, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x18000)) returned 1 [0045.508] GetLastError () returned 0x0 [0045.508] SetErrorMode (uMode=0x0) returned 0x1 [0045.510] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Users\\FD1HVy\\Desktop\\l25de3a0fbaa3009886613f5e62b92f2.exe", lpdwHandle=0x8fe34c | out: lpdwHandle=0x8fe34c) returned 0x73c [0045.510] GetLastError () returned 0x0 [0045.511] GetFileVersionInfoW (in: lptstrFilename="C:\\Users\\FD1HVy\\Desktop\\l25de3a0fbaa3009886613f5e62b92f2.exe", dwHandle=0x0, dwLen=0x73c, lpData=0x2a65c58 | out: lpData=0x2a65c58) returned 1 [0045.512] VerQueryValueW (in: pBlock=0x2a65c58, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x8fe318, puLen=0x8fe314 | out: lplpBuffer=0x8fe318*=0x2a65cf4, puLen=0x8fe314) returned 1 [0045.514] VerQueryValueW (in: pBlock=0x2a65c58, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x8fe294, puLen=0x8fe290 | out: lplpBuffer=0x8fe294*=0x0, puLen=0x8fe290) returned 0 [0045.514] VerQueryValueW (in: pBlock=0x2a65c58, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x8fe294, puLen=0x8fe290 | out: lplpBuffer=0x8fe294*=0x2a65d5c, puLen=0x8fe290) returned 1 [0045.514] lstrlenW (lpString="l25de3a0fbaa3009886613f5e62b92f2") returned 32 [0045.514] lstrcpyW (in: lpString1=0x9ea1f8, lpString2="l25de3a0fbaa3009886613f5e62b92f2" | out: lpString1="l25de3a0fbaa3009886613f5e62b92f2") returned="l25de3a0fbaa3009886613f5e62b92f2" [0045.514] VerQueryValueW (in: pBlock=0x2a65c58, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x8fe294, puLen=0x8fe290 | out: lplpBuffer=0x8fe294*=0x2a65dc0, puLen=0x8fe290) returned 1 [0045.514] lstrlenW (lpString="1.0.7129.18654") returned 14 [0045.514] lstrcpyW (in: lpString1=0x9ea1f8, lpString2="1.0.7129.18654" | out: lpString1="1.0.7129.18654") returned="1.0.7129.18654" [0045.514] VerQueryValueW (in: pBlock=0x2a65c58, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x8fe294, puLen=0x8fe290 | out: lplpBuffer=0x8fe294*=0x2a65e00, puLen=0x8fe290) returned 1 [0045.514] lstrlenW (lpString="l25de3a0fbaa3009886613f5e62b92f2.exe") returned 36 [0045.514] lstrcpyW (in: lpString1=0x9ea1f8, lpString2="l25de3a0fbaa3009886613f5e62b92f2.exe" | out: lpString1="l25de3a0fbaa3009886613f5e62b92f2.exe") returned="l25de3a0fbaa3009886613f5e62b92f2.exe" [0045.514] VerQueryValueW (in: pBlock=0x2a65c58, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x8fe294, puLen=0x8fe290 | out: lplpBuffer=0x8fe294*=0x2a65e70, puLen=0x8fe290) returned 1 [0045.514] lstrlenW (lpString="Copyright 2019") returned 14 [0045.514] lstrcpyW (in: lpString1=0x9ea1f8, lpString2="Copyright 2019" | out: lpString1="Copyright 2019") returned="Copyright 2019" [0045.514] VerQueryValueW (in: pBlock=0x2a65c58, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x8fe294, puLen=0x8fe290 | out: lplpBuffer=0x8fe294*=0x2a65eb8, puLen=0x8fe290) returned 1 [0045.514] lstrlenW (lpString="l25de3a0fbaa3009886613f5e62b92f2.exe") returned 36 [0045.514] lstrcpyW (in: lpString1=0x9ea1f8, lpString2="l25de3a0fbaa3009886613f5e62b92f2.exe" | out: lpString1="l25de3a0fbaa3009886613f5e62b92f2.exe") returned="l25de3a0fbaa3009886613f5e62b92f2.exe" [0045.514] VerQueryValueW (in: pBlock=0x2a65c58, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x8fe294, puLen=0x8fe290 | out: lplpBuffer=0x8fe294*=0x2a65f24, puLen=0x8fe290) returned 1 [0045.514] lstrlenW (lpString="l25de3a0fbaa3009886613f5e62b92f2") returned 32 [0045.514] lstrcpyW (in: lpString1=0x9ea1f8, lpString2="l25de3a0fbaa3009886613f5e62b92f2" | out: lpString1="l25de3a0fbaa3009886613f5e62b92f2") returned="l25de3a0fbaa3009886613f5e62b92f2" [0045.515] VerQueryValueW (in: pBlock=0x2a65c58, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x8fe294, puLen=0x8fe290 | out: lplpBuffer=0x8fe294*=0x2a65f8c, puLen=0x8fe290) returned 1 [0045.515] lstrlenW (lpString="1.0.7129.18654") returned 14 [0045.515] lstrcpyW (in: lpString1=0x9ea1f8, lpString2="1.0.7129.18654" | out: lpString1="1.0.7129.18654") returned="1.0.7129.18654" [0045.515] VerQueryValueW (in: pBlock=0x2a65c58, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x8fe294, puLen=0x8fe290 | out: lplpBuffer=0x8fe294*=0x0, puLen=0x8fe290) returned 0 [0045.515] VerQueryValueW (in: pBlock=0x2a65c58, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x8fe294, puLen=0x8fe290 | out: lplpBuffer=0x8fe294*=0x0, puLen=0x8fe290) returned 0 [0045.515] VerQueryValueW (in: pBlock=0x2a65c58, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x8fe294, puLen=0x8fe290 | out: lplpBuffer=0x8fe294*=0x0, puLen=0x8fe290) returned 0 [0045.515] VerQueryValueW (in: pBlock=0x2a65c58, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x8fe294, puLen=0x8fe290 | out: lplpBuffer=0x8fe294*=0x0, puLen=0x8fe290) returned 0 [0045.515] VerQueryValueW (in: pBlock=0x2a65c58, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x8fe288, puLen=0x8fe284 | out: lplpBuffer=0x8fe288*=0x2a65cf4, puLen=0x8fe284) returned 1 [0045.515] VerLanguageNameW (in: wLang=0x0, szLang=0xa21e98, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10 [0045.714] VerQueryValueW (in: pBlock=0x2a65c58, lpSubBlock="\\", lplpBuffer=0x8fe29c, puLen=0x8fe298 | out: lplpBuffer=0x8fe29c*=0x2a65c80, puLen=0x8fe298) returned 1 [0045.715] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\l25de3a0fbaa3009886613f5e62b92f2\\l25de3a0fbaa3009886613f5e62b92f2\\1.0.7129.18654", ulOptions=0x0, samDesired=0x20019, phkResult=0x8fe32c | out: phkResult=0x8fe32c*=0x0) returned 0x2 [0045.718] GetWindowThreadProcessId (in: hWnd=0x701dc, lpdwProcessId=0x8fe354 | out: lpdwProcessId=0x8fe354) returned 0x540 [0045.718] GetCurrentThreadId () returned 0x540 [0045.719] RegisterClipboardFormatW (lpszFormat="WindowsForms12_ThreadCallbackMessage") returned 0xc174 [0045.737] LocalFree (hMem=0xa1e080) returned 0x0 [0045.737] GetLastError () returned 0x0 [0045.737] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x201a, wParam=0x0, lParam=0xa1e080) returned 0x0 [0046.630] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe5e4) returned 0x0 [0046.630] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe5e4) returned 0x0 [0046.635] GetWindowPlacement (in: hWnd=0x7002e, lpwndpl=0x8fe320 | out: lpwndpl=0x8fe320) returned 1 [0046.635] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x47, wParam=0x0, lParam=0x8fe5e4) returned 0x0 [0046.635] GetClientRect (in: hWnd=0x7002e, lpRect=0x8fe2bc | out: lpRect=0x8fe2bc) returned 1 [0046.636] GetWindowRect (in: hWnd=0x7002e, lpRect=0x8fe2bc | out: lpRect=0x8fe2bc) returned 1 [0046.636] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x47, wParam=0x0, lParam=0x8fe5e4) returned 0x0 [0046.643] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0046.751] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe0b4) returned 0x0 [0046.752] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe0b4) returned 0x0 [0046.752] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x3020c) returned 0x1 [0046.753] SetFocus (hWnd=0x7002e) returned 0x3020c [0046.755] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0046.761] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0046.761] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0046.762] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0046.762] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x3020c, lParam=0x0) returned 0x0 [0046.769] IsWindow (hWnd=0x7002e) returned 1 [0046.770] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0046.770] IsWindow (hWnd=0x7002e) returned 1 [0046.770] SetFocus (hWnd=0x7002e) returned 0x7002e [0046.771] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0046.771] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0046.771] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0046.774] GetProcessWindowStation () returned 0x13c [0046.774] GetActiveWindow () returned 0x7002e [0046.774] GetCurrentActCtx (in: lphActCtx=0x8fe9f4 | out: lphActCtx=0x8fe9f4*=0x9f8cbc) returned 1 [0046.775] GetCurrentThreadId () returned 0x540 [0046.775] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c1102, lParam=0x0) returned 1 [0046.775] IsWindowVisible (hWnd=0x7002e) returned 0 [0046.775] IsWindowVisible (hWnd=0x4020e) returned 0 [0046.775] IsWindowVisible (hWnd=0x60044) returned 0 [0046.775] IsWindowVisible (hWnd=0x2021a) returned 0 [0046.775] IsWindowVisible (hWnd=0x8004a) returned 0 [0046.775] GetActiveWindow () returned 0x7002e [0046.776] GetFocus () returned 0x7002e [0046.776] MessageBoxW (hWnd=0x7002e, lpText="XurKlX/wg4XM44IZQpq48g==", lpCaption="", uType=0x0) returned 1 [0046.777] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0046.777] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0046.778] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0046.778] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0046.778] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0046.778] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0046.784] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x4020c) returned 0x1 [0046.785] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe2ac) returned 0x0 [0046.785] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe2ac) returned 0x0 [0047.112] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0047.122] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe0b4) returned 0x0 [0047.122] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe0b4) returned 0x0 [0047.122] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x4020c) returned 0x1 [0047.123] SetFocus (hWnd=0x7002e) returned 0x4020c [0047.125] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0047.126] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0047.126] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0047.127] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0047.127] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x4020c, lParam=0x0) returned 0x0 [0047.131] IsWindow (hWnd=0x7002e) returned 1 [0047.131] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0047.131] IsWindow (hWnd=0x7002e) returned 1 [0047.131] SetFocus (hWnd=0x7002e) returned 0x7002e [0047.132] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0047.132] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0047.132] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0047.132] GetFullPathNameW (in: lpFileName="C:\\Users\\desktop.ini", nBufferLength=0x105, lpBuffer=0x8fe5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\desktop.ini", lpFilePart=0x0) returned 0x14 [0047.132] GetLastError () returned 0x0 [0047.133] SetFileAttributesW (lpFileName="C:\\Users\\desktop.ini", dwFileAttributes=0x80) returned 1 [0047.134] GetLastError () returned 0x0 [0047.136] GetFullPathNameW (in: lpFileName="C:\\Users\\desktop.ini", nBufferLength=0x105, lpBuffer=0x8fe4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\desktop.ini", lpFilePart=0x0) returned 0x14 [0047.136] GetLastError () returned 0x0 [0047.136] SetErrorMode (uMode=0x1) returned 0x0 [0047.139] CreateFileW (lpFileName="C:\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0047.139] GetLastError () returned 0x0 [0047.140] GetFileType (hFile=0x440) returned 0x1 [0047.140] SetErrorMode (uMode=0x0) returned 0x1 [0047.140] GetFileType (hFile=0x440) returned 0x1 [0047.141] GetFileSize (in: hFile=0x440, lpFileSizeHigh=0x8fea74 | out: lpFileSizeHigh=0x8fea74*=0x0) returned 0xae [0047.141] GetLastError () returned 0x0 [0047.142] ReadFile (in: hFile=0x440, lpBuffer=0x2a68f64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fea1c, lpOverlapped=0x0 | out: lpBuffer=0x2a68f64*, lpNumberOfBytesRead=0x8fea1c*=0xae, lpOverlapped=0x0) returned 1 [0047.143] GetLastError () returned 0x0 [0047.144] CloseHandle (hObject=0x440) returned 1 [0047.144] GetLastError () returned 0x0 [0047.145] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0047.145] GetLastError () returned 0x0 [0047.146] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe9c4 | out: phKey=0x8fe9c4*=0x9f5ba0) returned 1 [0047.153] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0047.153] GetLastError () returned 0x0 [0047.153] CryptSetKeyParam (hKey=0x9f5ba0, dwParam=0x4, pbData=0x2a69fd8*=0x1, dwFlags=0x0) returned 1 [0047.153] GetLastError () returned 0x0 [0047.153] CryptSetKeyParam (hKey=0x9f5ba0, dwParam=0x1, pbData=0x2a69fa4, dwFlags=0x0) returned 1 [0047.153] GetLastError () returned 0x0 [0047.156] CryptEncrypt (in: hKey=0x9f5ba0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2a69fe8*, pdwDataLen=0x8fea7c*=0xb0, dwBufLen=0xb0 | out: pbData=0x2a69fe8*, pdwDataLen=0x8fea7c*=0xb0) returned 1 [0047.156] GetLastError () returned 0x0 [0047.156] CryptEncrypt (in: hKey=0x9f5ba0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2a6a0b8*, pdwDataLen=0x8fea84*=0x0, dwBufLen=0x10 | out: pbData=0x2a6a0b8*, pdwDataLen=0x8fea84*=0x10) returned 1 [0047.156] GetLastError () returned 0x0 [0047.169] GetFullPathNameW (in: lpFileName="C:\\Users\\desktop.ini", nBufferLength=0x105, lpBuffer=0x8fe4c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\desktop.ini", lpFilePart=0x0) returned 0x14 [0047.169] GetLastError () returned 0x0 [0047.169] SetErrorMode (uMode=0x1) returned 0x0 [0047.169] CreateFileW (lpFileName="C:\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0047.170] GetLastError () returned 0xb7 [0047.170] GetFileType (hFile=0x440) returned 0x1 [0047.170] SetErrorMode (uMode=0x0) returned 0x1 [0047.170] GetFileType (hFile=0x440) returned 0x1 [0047.170] WriteFile (in: hFile=0x440, lpBuffer=0x2a6a3c8*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x8fe9f0, lpOverlapped=0x0 | out: lpBuffer=0x2a6a3c8*, lpNumberOfBytesWritten=0x8fe9f0*=0xb0, lpOverlapped=0x0) returned 1 [0047.171] GetLastError () returned 0xb7 [0047.171] CloseHandle (hObject=0x440) returned 1 [0047.173] GetLastError () returned 0xb7 [0047.173] GetFullPathNameW (in: lpFileName="C:\\Users\\desktop.ini.XurKlX#wg4XM44IZQpq48g==.bwall", nBufferLength=0x105, lpBuffer=0x8fe4c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\desktop.ini.XurKlX#wg4XM44IZQpq48g==.bwall", lpFilePart=0x0) returned 0x33 [0047.173] GetLastError () returned 0xb7 [0047.173] SetErrorMode (uMode=0x1) returned 0x0 [0047.173] CreateFileW (lpFileName="C:\\Users\\desktop.ini.XurKlX#wg4XM44IZQpq48g==.bwall" (normalized: "c:\\users\\desktop.ini.xurklx#wg4xm44izqpq48g==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0047.174] GetLastError () returned 0x0 [0047.174] GetFileType (hFile=0x440) returned 0x1 [0047.174] SetErrorMode (uMode=0x0) returned 0x1 [0047.175] GetFileType (hFile=0x440) returned 0x1 [0047.175] WriteFile (in: hFile=0x440, lpBuffer=0x2a6b610*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x8fe9f0, lpOverlapped=0x0 | out: lpBuffer=0x2a6b610*, lpNumberOfBytesWritten=0x8fe9f0*=0xb0, lpOverlapped=0x0) returned 1 [0047.176] GetLastError () returned 0x0 [0047.176] CloseHandle (hObject=0x440) returned 1 [0047.176] GetLastError () returned 0x0 [0047.176] GetFullPathNameW (in: lpFileName="C:\\Users\\desktop.ini", nBufferLength=0x105, lpBuffer=0x8fe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\desktop.ini", lpFilePart=0x0) returned 0x14 [0047.176] GetLastError () returned 0x0 [0047.177] DeleteFileW (lpFileName="C:\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini")) returned 1 [0047.180] GetLastError () returned 0x0 [0047.183] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x8fe5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0047.183] GetLastError () returned 0x0 [0047.183] SetErrorMode (uMode=0x1) returned 0x0 [0047.184] FindFirstFileW (in: lpFileName="C:\\Users\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xcb7b5537, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f67e0 [0047.184] GetLastError () returned 0x0 [0047.184] FindNextFileW (in: hFindFile=0x9f67e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xcb7b5537, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.184] GetLastError () returned 0x0 [0047.184] FindNextFileW (in: hFindFile=0x9f67e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xd7b844b1, ftCreationTime.dwHighDateTime=0x1d2a02f, ftLastAccessTime.dwLowDateTime=0xd7b844b1, ftLastAccessTime.dwHighDateTime=0x1d2a02f, ftLastWriteTime.dwLowDateTime=0xd7b844b1, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0047.184] GetLastError () returned 0x0 [0047.184] FindNextFileW (in: hFindFile=0x9f67e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0047.184] GetLastError () returned 0x0 [0047.184] FindNextFileW (in: hFindFile=0x9f67e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xd7b844b1, ftCreationTime.dwHighDateTime=0x1d2a02f, ftLastAccessTime.dwLowDateTime=0xd7b844b1, ftLastAccessTime.dwHighDateTime=0x1d2a02f, ftLastWriteTime.dwLowDateTime=0xd7b844b1, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0047.184] GetLastError () returned 0x0 [0047.184] FindNextFileW (in: hFindFile=0x9f67e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default.migrated", cAlternateFileName="DEFAUL~1.MIG")) returned 1 [0047.184] GetLastError () returned 0x0 [0047.185] FindNextFileW (in: hFindFile=0x9f67e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb7b5537, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xcb7b5537, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xcb7b5537, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini.XurKlX#wg4XM44IZQpq48g==.bwall", cAlternateFileName="DESKTO~1.BWA")) returned 1 [0047.185] GetLastError () returned 0x0 [0047.185] FindNextFileW (in: hFindFile=0x9f67e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 1 [0047.185] GetLastError () returned 0x0 [0047.185] FindNextFileW (in: hFindFile=0x9f67e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 1 [0047.185] GetLastError () returned 0x0 [0047.185] FindNextFileW (in: hFindFile=0x9f67e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 0 [0047.185] GetLastError () returned 0x12 [0047.185] FindClose (in: hFindFile=0x9f67e0 | out: hFindFile=0x9f67e0) returned 1 [0047.185] SetErrorMode (uMode=0x0) returned 0x1 [0047.185] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users", nBufferLength=0x105, lpBuffer=0x8fe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users", lpFilePart=0x0) returned 0x12 [0047.185] GetLastError () returned 0x12 [0047.185] SetErrorMode (uMode=0x1) returned 0x0 [0047.186] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x450f4738, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f67a0 [0047.186] GetLastError () returned 0x12 [0047.186] FindNextFileW (in: hFindFile=0x9f67a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x450f4738, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.186] GetLastError () returned 0x12 [0047.186] FindNextFileW (in: hFindFile=0x9f67a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x450f4738, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x4511a9a6, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x4511a9a6, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0047.186] GetLastError () returned 0x12 [0047.186] FindNextFileW (in: hFindFile=0x9f67a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0047.186] GetLastError () returned 0x12 [0047.186] FindNextFileW (in: hFindFile=0x9f67a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Comms", cAlternateFileName="")) returned 1 [0047.186] GetLastError () returned 0x12 [0047.187] FindNextFileW (in: hFindFile=0x9f67a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0047.187] GetLastError () returned 0x12 [0047.187] FindNextFileW (in: hFindFile=0x9f67a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0047.187] GetLastError () returned 0x12 [0047.187] FindNextFileW (in: hFindFile=0x9f67a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0047.187] GetLastError () returned 0x12 [0047.187] FindNextFileW (in: hFindFile=0x9f67a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3ecd6462, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3ecd6462, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft OneDrive", cAlternateFileName="MICROS~2")) returned 1 [0047.187] GetLastError () returned 0x12 [0047.187] FindNextFileW (in: hFindFile=0x9f67a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa2d56a03, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa2d56a03, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Oracle", cAlternateFileName="")) returned 1 [0047.187] GetLastError () returned 0x12 [0047.187] FindNextFileW (in: hFindFile=0x9f67a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdefc9a0c, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdefc9a0c, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1 [0047.187] GetLastError () returned 0x12 [0047.188] FindNextFileW (in: hFindFile=0x9f67a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3122174, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x53fba98c, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft", cAlternateFileName="REGID1~1.MIC")) returned 1 [0047.188] GetLastError () returned 0x12 [0047.188] FindNextFileW (in: hFindFile=0x9f67a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SoftwareDistribution", cAlternateFileName="SOFTWA~1")) returned 1 [0047.188] GetLastError () returned 0x12 [0047.188] FindNextFileW (in: hFindFile=0x9f67a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x7877b7ce, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x7877b7ce, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7877b7ce, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0047.188] GetLastError () returned 0x12 [0047.188] FindNextFileW (in: hFindFile=0x9f67a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x7877b7ce, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x7877b7ce, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7877b7ce, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0047.188] GetLastError () returned 0x12 [0047.188] FindNextFileW (in: hFindFile=0x9f67a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1931975, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1931975, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="USOPrivate", cAlternateFileName="USOPRI~1")) returned 1 [0047.188] GetLastError () returned 0x12 [0047.188] FindNextFileW (in: hFindFile=0x9f67a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa4ade3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa4ade3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="USOShared", cAlternateFileName="USOSHA~1")) returned 1 [0047.188] GetLastError () returned 0x12 [0047.188] FindNextFileW (in: hFindFile=0x9f67a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WindowsHolographicDevices", cAlternateFileName="WINDOW~1")) returned 1 [0047.188] GetLastError () returned 0x12 [0047.189] FindNextFileW (in: hFindFile=0x9f67a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WindowsHolographicDevices", cAlternateFileName="WINDOW~1")) returned 0 [0047.189] GetLastError () returned 0x12 [0047.189] FindClose (in: hFindFile=0x9f67a0 | out: hFindFile=0x9f67a0) returned 1 [0047.189] SetErrorMode (uMode=0x0) returned 0x1 [0047.189] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users", nBufferLength=0x105, lpBuffer=0x8fe570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users", lpFilePart=0x0) returned 0x12 [0047.189] GetLastError () returned 0x12 [0047.189] SetErrorMode (uMode=0x1) returned 0x0 [0047.189] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x450f4738, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6560 [0047.189] GetLastError () returned 0x12 [0047.189] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x450f4738, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.189] GetLastError () returned 0x12 [0047.189] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x450f4738, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x4511a9a6, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x4511a9a6, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0047.189] GetLastError () returned 0x12 [0047.190] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0047.190] GetLastError () returned 0x12 [0047.190] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Comms", cAlternateFileName="")) returned 1 [0047.190] GetLastError () returned 0x12 [0047.190] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0047.190] GetLastError () returned 0x12 [0047.190] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0047.190] GetLastError () returned 0x12 [0047.190] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0047.190] GetLastError () returned 0x12 [0047.190] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3ecd6462, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3ecd6462, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft OneDrive", cAlternateFileName="MICROS~2")) returned 1 [0047.190] GetLastError () returned 0x12 [0047.190] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa2d56a03, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa2d56a03, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Oracle", cAlternateFileName="")) returned 1 [0047.190] GetLastError () returned 0x12 [0047.191] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdefc9a0c, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdefc9a0c, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1 [0047.191] GetLastError () returned 0x12 [0047.191] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3122174, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x53fba98c, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft", cAlternateFileName="REGID1~1.MIC")) returned 1 [0047.191] GetLastError () returned 0x12 [0047.191] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SoftwareDistribution", cAlternateFileName="SOFTWA~1")) returned 1 [0047.191] GetLastError () returned 0x12 [0047.191] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x7877b7ce, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x7877b7ce, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7877b7ce, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0047.191] GetLastError () returned 0x12 [0047.191] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x7877b7ce, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x7877b7ce, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7877b7ce, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0047.191] GetLastError () returned 0x12 [0047.191] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1931975, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1931975, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="USOPrivate", cAlternateFileName="USOPRI~1")) returned 1 [0047.191] GetLastError () returned 0x12 [0047.192] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa4ade3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa4ade3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="USOShared", cAlternateFileName="USOSHA~1")) returned 1 [0047.192] GetLastError () returned 0x12 [0047.192] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WindowsHolographicDevices", cAlternateFileName="WINDOW~1")) returned 1 [0047.192] GetLastError () returned 0x12 [0047.192] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WindowsHolographicDevices", cAlternateFileName="WINDOW~1")) returned 0 [0047.192] GetLastError () returned 0x12 [0047.193] FindClose (in: hFindFile=0x9f6560 | out: hFindFile=0x9f6560) returned 1 [0047.193] SetErrorMode (uMode=0x0) returned 0x1 [0047.193] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe", nBufferLength=0x105, lpBuffer=0x8fe53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe", lpFilePart=0x0) returned 0x18 [0047.193] GetLastError () returned 0x12 [0047.193] SetErrorMode (uMode=0x1) returned 0x0 [0047.193] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x450f4738, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x4511a9a6, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x4511a9a6, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6660 [0047.193] GetLastError () returned 0x12 [0047.193] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x450f4738, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x4511a9a6, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x4511a9a6, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.193] GetLastError () returned 0x12 [0047.194] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="")) returned 1 [0047.194] GetLastError () returned 0x12 [0047.194] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="")) returned 0 [0047.194] GetLastError () returned 0x12 [0047.194] FindClose (in: hFindFile=0x9f6660 | out: hFindFile=0x9f6660) returned 1 [0047.194] SetErrorMode (uMode=0x0) returned 0x1 [0047.194] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe", nBufferLength=0x105, lpBuffer=0x8fe53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe", lpFilePart=0x0) returned 0x18 [0047.194] GetLastError () returned 0x12 [0047.194] SetErrorMode (uMode=0x1) returned 0x0 [0047.194] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x450f4738, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x4511a9a6, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x4511a9a6, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f61a0 [0047.194] GetLastError () returned 0x12 [0047.194] FindNextFileW (in: hFindFile=0x9f61a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x450f4738, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x4511a9a6, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x4511a9a6, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.194] GetLastError () returned 0x12 [0047.195] FindNextFileW (in: hFindFile=0x9f61a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="")) returned 1 [0047.195] GetLastError () returned 0x12 [0047.195] FindNextFileW (in: hFindFile=0x9f61a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="")) returned 0 [0047.195] GetLastError () returned 0x12 [0047.195] FindClose (in: hFindFile=0x9f61a0 | out: hFindFile=0x9f61a0) returned 1 [0047.195] SetErrorMode (uMode=0x0) returned 0x1 [0047.196] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM", nBufferLength=0x105, lpBuffer=0x8fe508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM", lpFilePart=0x0) returned 0x1c [0047.196] GetLastError () returned 0x12 [0047.196] SetErrorMode (uMode=0x1) returned 0x0 [0047.196] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f65e0 [0047.197] GetLastError () returned 0x12 [0047.197] FindNextFileW (in: hFindFile=0x9f65e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.197] GetLastError () returned 0x12 [0047.197] FindNextFileW (in: hFindFile=0x9f65e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xfb2ddff7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3268450e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_15.007.20033", cAlternateFileName="READER~1.200")) returned 1 [0047.197] GetLastError () returned 0x12 [0047.197] FindNextFileW (in: hFindFile=0x9f65e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xa7140105, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_15.023.20070", cAlternateFileName="READER~2.200")) returned 1 [0047.197] GetLastError () returned 0x12 [0047.198] FindNextFileW (in: hFindFile=0x9f65e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S", cAlternateFileName="")) returned 1 [0047.198] GetLastError () returned 0x12 [0047.198] FindNextFileW (in: hFindFile=0x9f65e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S", cAlternateFileName="")) returned 0 [0047.198] GetLastError () returned 0x12 [0047.198] FindClose (in: hFindFile=0x9f65e0 | out: hFindFile=0x9f65e0) returned 1 [0047.199] SetErrorMode (uMode=0x0) returned 0x1 [0047.199] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM", nBufferLength=0x105, lpBuffer=0x8fe508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM", lpFilePart=0x0) returned 0x1c [0047.199] GetLastError () returned 0x12 [0047.199] SetErrorMode (uMode=0x1) returned 0x0 [0047.199] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6560 [0047.199] GetLastError () returned 0x12 [0047.200] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.200] GetLastError () returned 0x12 [0047.200] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xfb2ddff7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3268450e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_15.007.20033", cAlternateFileName="READER~1.200")) returned 1 [0047.200] GetLastError () returned 0x12 [0047.200] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xa7140105, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_15.023.20070", cAlternateFileName="READER~2.200")) returned 1 [0047.200] GetLastError () returned 0x12 [0047.200] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S", cAlternateFileName="")) returned 1 [0047.200] GetLastError () returned 0x12 [0047.200] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S", cAlternateFileName="")) returned 0 [0047.200] GetLastError () returned 0x12 [0047.200] FindClose (in: hFindFile=0x9f6560 | out: hFindFile=0x9f6560) returned 1 [0047.201] SetErrorMode (uMode=0x0) returned 0x1 [0047.201] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.007.20033", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.007.20033", lpFilePart=0x0) returned 0x30 [0047.201] GetLastError () returned 0x12 [0047.201] SetErrorMode (uMode=0x1) returned 0x0 [0047.201] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.007.20033\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xfb2ddff7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3268450e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f67e0 [0047.203] GetLastError () returned 0x12 [0047.203] FindNextFileW (in: hFindFile=0x9f67e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xfb2ddff7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3268450e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.203] GetLastError () returned 0x12 [0047.204] FindNextFileW (in: hFindFile=0x9f67e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xfb2ddff7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3268450e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0047.204] GetLastError () returned 0x12 [0047.204] FindClose (in: hFindFile=0x9f67e0 | out: hFindFile=0x9f67e0) returned 1 [0047.204] SetErrorMode (uMode=0x0) returned 0x1 [0047.204] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.007.20033", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.007.20033", lpFilePart=0x0) returned 0x30 [0047.204] GetLastError () returned 0x12 [0047.204] SetErrorMode (uMode=0x1) returned 0x0 [0047.204] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.007.20033\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xfb2ddff7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3268450e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6660 [0047.204] GetLastError () returned 0x12 [0047.204] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xfb2ddff7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3268450e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.204] GetLastError () returned 0x12 [0047.204] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xfb2ddff7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3268450e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0047.204] GetLastError () returned 0x12 [0047.205] FindClose (in: hFindFile=0x9f6660 | out: hFindFile=0x9f6660) returned 1 [0047.205] SetErrorMode (uMode=0x0) returned 0x1 [0047.207] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.007.20033\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.007.20033\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x43 [0047.207] GetLastError () returned 0x12 [0047.207] SetErrorMode (uMode=0x1) returned 0x0 [0047.207] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.007.20033\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_15.007.20033\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x440 [0047.208] GetLastError () returned 0x0 [0047.208] GetFileType (hFile=0x440) returned 0x1 [0047.208] SetErrorMode (uMode=0x0) returned 0x1 [0047.208] GetFileType (hFile=0x440) returned 0x1 [0047.209] WriteFile (in: hFile=0x440, lpBuffer=0x2a7a970*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe968, lpOverlapped=0x0 | out: lpBuffer=0x2a7a970*, lpNumberOfBytesWritten=0x8fe968*=0xbcb, lpOverlapped=0x0) returned 1 [0047.213] GetLastError () returned 0x0 [0047.213] CloseHandle (hObject=0x440) returned 1 [0047.214] GetLastError () returned 0x0 [0047.214] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.023.20070", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.023.20070", lpFilePart=0x0) returned 0x30 [0047.214] GetLastError () returned 0x0 [0047.214] SetErrorMode (uMode=0x1) returned 0x0 [0047.214] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.023.20070\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x2797fc81, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f66a0 [0047.214] GetLastError () returned 0x0 [0047.214] FindNextFileW (in: hFindFile=0x9f66a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x2797fc81, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.215] GetLastError () returned 0x0 [0047.215] FindNextFileW (in: hFindFile=0x9f66a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x2797fc81, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0047.215] GetLastError () returned 0x12 [0047.215] FindClose (in: hFindFile=0x9f66a0 | out: hFindFile=0x9f66a0) returned 1 [0047.215] SetErrorMode (uMode=0x0) returned 0x1 [0047.215] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.023.20070", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.023.20070", lpFilePart=0x0) returned 0x30 [0047.215] GetLastError () returned 0x12 [0047.215] SetErrorMode (uMode=0x1) returned 0x0 [0047.215] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.023.20070\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x2797fc81, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6220 [0047.216] GetLastError () returned 0x12 [0047.216] FindNextFileW (in: hFindFile=0x9f6220, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x2797fc81, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.216] GetLastError () returned 0x12 [0047.216] FindNextFileW (in: hFindFile=0x9f6220, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x2797fc81, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0047.216] GetLastError () returned 0x12 [0047.216] FindClose (in: hFindFile=0x9f6220 | out: hFindFile=0x9f6220) returned 1 [0047.216] SetErrorMode (uMode=0x0) returned 0x1 [0047.217] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.023.20070\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.023.20070\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x43 [0047.217] GetLastError () returned 0x12 [0047.217] SetErrorMode (uMode=0x1) returned 0x0 [0047.217] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.023.20070\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_15.023.20070\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x440 [0047.217] GetLastError () returned 0x0 [0047.217] GetFileType (hFile=0x440) returned 0x1 [0047.217] SetErrorMode (uMode=0x0) returned 0x1 [0047.218] GetFileType (hFile=0x440) returned 0x1 [0047.218] WriteFile (in: hFile=0x440, lpBuffer=0x2a821d0*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe968, lpOverlapped=0x0 | out: lpBuffer=0x2a821d0*, lpNumberOfBytesWritten=0x8fe968*=0xbcb, lpOverlapped=0x0) returned 1 [0047.219] GetLastError () returned 0x0 [0047.219] CloseHandle (hObject=0x440) returned 1 [0047.219] GetLastError () returned 0x0 [0047.219] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\S", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\S", lpFilePart=0x0) returned 0x1e [0047.219] GetLastError () returned 0x0 [0047.219] SetErrorMode (uMode=0x1) returned 0x0 [0047.219] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\S\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6560 [0047.220] GetLastError () returned 0x0 [0047.220] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.220] GetLastError () returned 0x0 [0047.220] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0047.220] GetLastError () returned 0x12 [0047.220] FindClose (in: hFindFile=0x9f6560 | out: hFindFile=0x9f6560) returned 1 [0047.220] SetErrorMode (uMode=0x0) returned 0x1 [0047.220] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\S", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\S", lpFilePart=0x0) returned 0x1e [0047.220] GetLastError () returned 0x12 [0047.220] SetErrorMode (uMode=0x1) returned 0x0 [0047.221] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\S\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6120 [0047.221] GetLastError () returned 0x12 [0047.221] FindNextFileW (in: hFindFile=0x9f6120, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.221] GetLastError () returned 0x12 [0047.221] FindNextFileW (in: hFindFile=0x9f6120, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0047.221] GetLastError () returned 0x12 [0047.221] FindClose (in: hFindFile=0x9f6120 | out: hFindFile=0x9f6120) returned 1 [0047.221] SetErrorMode (uMode=0x0) returned 0x1 [0047.222] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\S\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\S\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x31 [0047.222] GetLastError () returned 0x12 [0047.222] SetErrorMode (uMode=0x1) returned 0x0 [0047.222] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\S\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\adobe\\arm\\s\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x440 [0047.223] GetLastError () returned 0x0 [0047.223] GetFileType (hFile=0x440) returned 0x1 [0047.223] SetErrorMode (uMode=0x0) returned 0x1 [0047.223] GetFileType (hFile=0x440) returned 0x1 [0047.224] WriteFile (in: hFile=0x440, lpBuffer=0x2a89838*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe968, lpOverlapped=0x0 | out: lpBuffer=0x2a89838*, lpNumberOfBytesWritten=0x8fe968*=0xbcb, lpOverlapped=0x0) returned 1 [0047.229] GetLastError () returned 0x0 [0047.229] CloseHandle (hObject=0x440) returned 1 [0047.230] GetLastError () returned 0x0 [0047.230] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x2f [0047.230] GetLastError () returned 0x0 [0047.230] SetErrorMode (uMode=0x1) returned 0x0 [0047.230] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\adobe\\arm\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x440 [0047.231] GetLastError () returned 0x0 [0047.231] GetFileType (hFile=0x440) returned 0x1 [0047.231] SetErrorMode (uMode=0x0) returned 0x1 [0047.231] GetFileType (hFile=0x440) returned 0x1 [0047.231] WriteFile (in: hFile=0x440, lpBuffer=0x2a904e0*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe99c, lpOverlapped=0x0 | out: lpBuffer=0x2a904e0*, lpNumberOfBytesWritten=0x8fe99c*=0xbcb, lpOverlapped=0x0) returned 1 [0047.232] GetLastError () returned 0x0 [0047.232] CloseHandle (hObject=0x440) returned 1 [0047.232] GetLastError () returned 0x0 [0047.233] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe478, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x2b [0047.233] GetLastError () returned 0x0 [0047.233] SetErrorMode (uMode=0x1) returned 0x0 [0047.233] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\adobe\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x440 [0047.234] GetLastError () returned 0x0 [0047.234] GetFileType (hFile=0x440) returned 0x1 [0047.234] SetErrorMode (uMode=0x0) returned 0x1 [0047.234] GetFileType (hFile=0x440) returned 0x1 [0047.234] WriteFile (in: hFile=0x440, lpBuffer=0x2a97178*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe9d0, lpOverlapped=0x0 | out: lpBuffer=0x2a97178*, lpNumberOfBytesWritten=0x8fe9d0*=0xbcb, lpOverlapped=0x0) returned 1 [0047.235] GetLastError () returned 0x0 [0047.235] CloseHandle (hObject=0x440) returned 1 [0047.235] GetLastError () returned 0x0 [0047.235] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Application Data", nBufferLength=0x105, lpBuffer=0x8fe53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Application Data", lpFilePart=0x0) returned 0x23 [0047.235] GetLastError () returned 0x0 [0047.235] SetErrorMode (uMode=0x1) returned 0x0 [0047.235] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Application Data\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0047.236] GetLastError () returned 0x5 [0047.285] SetErrorMode (uMode=0x0) returned 0x1 [0047.285] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Application Data", nBufferLength=0x105, lpBuffer=0x8fe53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Application Data", lpFilePart=0x0) returned 0x23 [0047.285] GetLastError () returned 0x5 [0047.285] SetErrorMode (uMode=0x1) returned 0x0 [0047.285] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Application Data\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0047.285] GetLastError () returned 0x5 [0047.327] SetErrorMode (uMode=0x0) returned 0x1 [0047.327] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Comms", nBufferLength=0x105, lpBuffer=0x8fe53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Comms", lpFilePart=0x0) returned 0x18 [0047.327] GetLastError () returned 0x5 [0047.327] SetErrorMode (uMode=0x1) returned 0x0 [0047.327] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Comms\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f61a0 [0047.328] GetLastError () returned 0x5 [0047.328] FindNextFileW (in: hFindFile=0x9f61a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.328] GetLastError () returned 0x5 [0047.329] FindNextFileW (in: hFindFile=0x9f61a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0047.329] GetLastError () returned 0x12 [0047.329] FindClose (in: hFindFile=0x9f61a0 | out: hFindFile=0x9f61a0) returned 1 [0047.329] SetErrorMode (uMode=0x0) returned 0x1 [0047.329] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Comms", nBufferLength=0x105, lpBuffer=0x8fe53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Comms", lpFilePart=0x0) returned 0x18 [0047.329] GetLastError () returned 0x12 [0047.329] SetErrorMode (uMode=0x1) returned 0x0 [0047.329] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Comms\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f63a0 [0047.329] GetLastError () returned 0x12 [0047.330] FindNextFileW (in: hFindFile=0x9f63a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.330] GetLastError () returned 0x12 [0047.330] FindNextFileW (in: hFindFile=0x9f63a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0047.330] GetLastError () returned 0x12 [0047.330] FindClose (in: hFindFile=0x9f63a0 | out: hFindFile=0x9f63a0) returned 1 [0047.330] SetErrorMode (uMode=0x0) returned 0x1 [0047.331] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Comms\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe478, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Comms\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x2b [0047.331] GetLastError () returned 0x12 [0047.331] SetErrorMode (uMode=0x1) returned 0x0 [0047.331] CreateFileW (lpFileName="C:\\Users\\All Users\\Comms\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\comms\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x440 [0047.332] GetLastError () returned 0x0 [0047.332] GetFileType (hFile=0x440) returned 0x1 [0047.332] SetErrorMode (uMode=0x0) returned 0x1 [0047.332] GetFileType (hFile=0x440) returned 0x1 [0047.332] WriteFile (in: hFile=0x440, lpBuffer=0x2aacba0*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe9d0, lpOverlapped=0x0 | out: lpBuffer=0x2aacba0*, lpNumberOfBytesWritten=0x8fe9d0*=0xbcb, lpOverlapped=0x0) returned 1 [0047.333] GetLastError () returned 0x0 [0047.333] CloseHandle (hObject=0x440) returned 1 [0047.334] GetLastError () returned 0x0 [0047.334] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Desktop", nBufferLength=0x105, lpBuffer=0x8fe53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Desktop", lpFilePart=0x0) returned 0x1a [0047.334] GetLastError () returned 0x0 [0047.334] SetErrorMode (uMode=0x1) returned 0x0 [0047.334] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Desktop\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0047.335] GetLastError () returned 0x5 [0047.336] SetErrorMode (uMode=0x0) returned 0x1 [0047.337] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Desktop", nBufferLength=0x105, lpBuffer=0x8fe53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Desktop", lpFilePart=0x0) returned 0x1a [0047.337] GetLastError () returned 0x5 [0047.337] SetErrorMode (uMode=0x1) returned 0x0 [0047.337] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Desktop\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0047.337] GetLastError () returned 0x5 [0047.339] SetErrorMode (uMode=0x0) returned 0x1 [0047.339] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Documents", nBufferLength=0x105, lpBuffer=0x8fe53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Documents", lpFilePart=0x0) returned 0x1c [0047.339] GetLastError () returned 0x5 [0047.339] SetErrorMode (uMode=0x1) returned 0x0 [0047.339] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Documents\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0047.339] GetLastError () returned 0x5 [0047.341] SetErrorMode (uMode=0x0) returned 0x1 [0047.341] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Documents", nBufferLength=0x105, lpBuffer=0x8fe53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Documents", lpFilePart=0x0) returned 0x1c [0047.341] GetLastError () returned 0x5 [0047.341] SetErrorMode (uMode=0x1) returned 0x0 [0047.341] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Documents\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0047.342] GetLastError () returned 0x5 [0047.343] SetErrorMode (uMode=0x0) returned 0x1 [0047.343] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft", nBufferLength=0x105, lpBuffer=0x8fe53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft", lpFilePart=0x0) returned 0x1c [0047.343] GetLastError () returned 0x5 [0047.343] SetErrorMode (uMode=0x1) returned 0x0 [0047.343] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f61e0 [0047.343] GetLastError () returned 0x5 [0047.343] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.344] GetLastError () returned 0x5 [0047.344] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d3d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppV", cAlternateFileName="")) returned 1 [0047.344] GetLastError () returned 0x5 [0047.344] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c2b2f4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfa011b19, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfa011b19, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClickToRun", cAlternateFileName="CLICKT~1")) returned 1 [0047.344] GetLastError () returned 0x5 [0047.344] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1 [0047.344] GetLastError () returned 0x5 [0047.344] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataMart", cAlternateFileName="")) returned 1 [0047.344] GetLastError () returned 0x5 [0047.344] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1 [0047.344] GetLastError () returned 0x5 [0047.345] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeviceSync", cAlternateFileName="DEVICE~2")) returned 1 [0047.345] GetLastError () returned 0x5 [0047.345] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Diagnosis", cAlternateFileName="DIAGNO~1")) returned 1 [0047.345] GetLastError () returned 0x5 [0047.345] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71bd25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRM", cAlternateFileName="")) returned 1 [0047.345] GetLastError () returned 0x5 [0047.345] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x40368daa, ftLastAccessTime.dwHighDateTime=0x1d39f5f, ftLastWriteTime.dwLowDateTime=0x40368daa, ftLastWriteTime.dwHighDateTime=0x1d39f5f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1 [0047.345] GetLastError () returned 0x5 [0047.345] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7af95c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IdentityCRL", cAlternateFileName="IDENTI~1")) returned 1 [0047.345] GetLastError () returned 0x5 [0047.345] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd80cc32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MapData", cAlternateFileName="")) returned 1 [0047.345] GetLastError () returned 0x5 [0047.345] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80d7aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MF", cAlternateFileName="")) returned 1 [0047.345] GetLastError () returned 0x5 [0047.346] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80e29d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetFramework", cAlternateFileName="NETFRA~1")) returned 1 [0047.346] GetLastError () returned 0x5 [0047.346] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80ffe4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1 [0047.346] GetLastError () returned 0x5 [0047.346] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1 [0047.346] GetLastError () returned 0x5 [0047.346] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfee8021d, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xfee8021d, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Provisioning", cAlternateFileName="PROVIS~1")) returned 1 [0047.346] GetLastError () returned 0x5 [0047.346] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb79dd84e, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb7a500e7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb7a500e7, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 1 [0047.346] GetLastError () returned 0x5 [0047.346] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30e3b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0047.346] GetLastError () returned 0x5 [0047.347] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1dcfea0a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1dcfea0a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmsRouter", cAlternateFileName="SMSROU~1")) returned 1 [0047.347] GetLastError () returned 0x5 [0047.347] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe3607ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spectrum", cAlternateFileName="")) returned 1 [0047.347] GetLastError () returned 0x5 [0047.347] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe360d61, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech_OneCore", cAlternateFileName="SPEECH~1")) returned 1 [0047.347] GetLastError () returned 0x5 [0047.347] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcb4dcad0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xcb4dcad0, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Storage Health", cAlternateFileName="STORAG~1")) returned 1 [0047.347] GetLastError () returned 0x5 [0047.347] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe3615f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UEV", cAlternateFileName="")) returned 1 [0047.347] GetLastError () returned 0x5 [0047.347] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbaae4059, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xbaae4059, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Account Pictures", cAlternateFileName="USERAC~1")) returned 1 [0047.347] GetLastError () returned 0x5 [0047.348] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbe4bcf6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x448126f7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1 [0047.348] GetLastError () returned 0x5 [0047.348] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe4be180, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WDF", cAlternateFileName="")) returned 1 [0047.348] GetLastError () returned 0x5 [0047.348] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xedcf5f61, ftLastAccessTime.dwHighDateTime=0x1d336d9, ftLastWriteTime.dwLowDateTime=0xedcf5f61, ftLastWriteTime.dwHighDateTime=0x1d336d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0047.348] GetLastError () returned 0x5 [0047.348] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d4e74, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb320aac5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1 [0047.348] GetLastError () returned 0x5 [0047.348] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a90a48, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender Advanced Threat Protection", cAlternateFileName="WIF4A9~1")) returned 1 [0047.348] GetLastError () returned 0x5 [0047.348] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a928fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~2")) returned 1 [0047.348] GetLastError () returned 0x5 [0047.348] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a93496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~3")) returned 1 [0047.348] GetLastError () returned 0x5 [0047.349] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0ef6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Security Health", cAlternateFileName="WINDOW~4")) returned 1 [0047.349] GetLastError () returned 0x5 [0047.349] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbef9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMSIPC", cAlternateFileName="")) returned 1 [0047.349] GetLastError () returned 0x5 [0047.349] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 1 [0047.349] GetLastError () returned 0x5 [0047.349] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 0 [0047.349] GetLastError () returned 0x12 [0047.349] FindClose (in: hFindFile=0x9f61e0 | out: hFindFile=0x9f61e0) returned 1 [0047.349] SetErrorMode (uMode=0x0) returned 0x1 [0047.349] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft", nBufferLength=0x105, lpBuffer=0x8fe53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft", lpFilePart=0x0) returned 0x1c [0047.349] GetLastError () returned 0x12 [0047.349] SetErrorMode (uMode=0x1) returned 0x0 [0047.350] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f60a0 [0047.354] GetLastError () returned 0x12 [0047.354] FindNextFileW (in: hFindFile=0x9f60a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.354] GetLastError () returned 0x12 [0047.354] FindNextFileW (in: hFindFile=0x9f60a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d3d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppV", cAlternateFileName="")) returned 1 [0047.354] GetLastError () returned 0x12 [0047.354] FindNextFileW (in: hFindFile=0x9f60a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c2b2f4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfa011b19, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfa011b19, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClickToRun", cAlternateFileName="CLICKT~1")) returned 1 [0047.354] GetLastError () returned 0x12 [0047.355] FindNextFileW (in: hFindFile=0x9f60a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1 [0047.355] GetLastError () returned 0x12 [0047.355] FindNextFileW (in: hFindFile=0x9f60a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataMart", cAlternateFileName="")) returned 1 [0047.355] GetLastError () returned 0x12 [0047.355] FindNextFileW (in: hFindFile=0x9f60a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1 [0047.355] GetLastError () returned 0x12 [0047.355] FindNextFileW (in: hFindFile=0x9f60a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeviceSync", cAlternateFileName="DEVICE~2")) returned 1 [0047.355] GetLastError () returned 0x12 [0047.355] FindNextFileW (in: hFindFile=0x9f60a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Diagnosis", cAlternateFileName="DIAGNO~1")) returned 1 [0047.355] GetLastError () returned 0x12 [0047.355] FindNextFileW (in: hFindFile=0x9f60a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71bd25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRM", cAlternateFileName="")) returned 1 [0047.355] GetLastError () returned 0x12 [0047.356] FindNextFileW (in: hFindFile=0x9f60a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x40368daa, ftLastAccessTime.dwHighDateTime=0x1d39f5f, ftLastWriteTime.dwLowDateTime=0x40368daa, ftLastWriteTime.dwHighDateTime=0x1d39f5f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1 [0047.356] GetLastError () returned 0x12 [0047.356] FindNextFileW (in: hFindFile=0x9f60a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7af95c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IdentityCRL", cAlternateFileName="IDENTI~1")) returned 1 [0047.356] GetLastError () returned 0x12 [0047.356] FindNextFileW (in: hFindFile=0x9f60a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd80cc32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MapData", cAlternateFileName="")) returned 1 [0047.356] GetLastError () returned 0x12 [0047.356] FindNextFileW (in: hFindFile=0x9f60a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80d7aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MF", cAlternateFileName="")) returned 1 [0047.356] GetLastError () returned 0x12 [0047.356] FindNextFileW (in: hFindFile=0x9f60a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80e29d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetFramework", cAlternateFileName="NETFRA~1")) returned 1 [0047.356] GetLastError () returned 0x12 [0047.356] FindNextFileW (in: hFindFile=0x9f60a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80ffe4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1 [0047.356] GetLastError () returned 0x12 [0047.357] FindNextFileW (in: hFindFile=0x9f60a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1 [0047.357] GetLastError () returned 0x12 [0047.357] FindNextFileW (in: hFindFile=0x9f60a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfee8021d, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xfee8021d, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Provisioning", cAlternateFileName="PROVIS~1")) returned 1 [0047.357] GetLastError () returned 0x12 [0047.357] FindNextFileW (in: hFindFile=0x9f60a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb79dd84e, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb7a500e7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb7a500e7, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 1 [0047.357] GetLastError () returned 0x12 [0047.357] FindNextFileW (in: hFindFile=0x9f60a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30e3b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0047.357] GetLastError () returned 0x12 [0047.357] FindNextFileW (in: hFindFile=0x9f60a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1dcfea0a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1dcfea0a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmsRouter", cAlternateFileName="SMSROU~1")) returned 1 [0047.357] GetLastError () returned 0x12 [0047.357] FindNextFileW (in: hFindFile=0x9f60a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe3607ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spectrum", cAlternateFileName="")) returned 1 [0047.357] GetLastError () returned 0x12 [0047.358] FindNextFileW (in: hFindFile=0x9f60a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe360d61, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech_OneCore", cAlternateFileName="SPEECH~1")) returned 1 [0047.358] GetLastError () returned 0x12 [0047.358] FindNextFileW (in: hFindFile=0x9f60a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcb4dcad0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xcb4dcad0, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Storage Health", cAlternateFileName="STORAG~1")) returned 1 [0047.358] GetLastError () returned 0x12 [0047.358] FindNextFileW (in: hFindFile=0x9f60a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe3615f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UEV", cAlternateFileName="")) returned 1 [0047.358] GetLastError () returned 0x12 [0047.358] FindNextFileW (in: hFindFile=0x9f60a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbaae4059, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xbaae4059, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Account Pictures", cAlternateFileName="USERAC~1")) returned 1 [0047.358] GetLastError () returned 0x12 [0047.359] FindNextFileW (in: hFindFile=0x9f60a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbe4bcf6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x448126f7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1 [0047.359] GetLastError () returned 0x12 [0047.359] FindNextFileW (in: hFindFile=0x9f60a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe4be180, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WDF", cAlternateFileName="")) returned 1 [0047.359] GetLastError () returned 0x12 [0047.359] FindNextFileW (in: hFindFile=0x9f60a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xedcf5f61, ftLastAccessTime.dwHighDateTime=0x1d336d9, ftLastWriteTime.dwLowDateTime=0xedcf5f61, ftLastWriteTime.dwHighDateTime=0x1d336d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0047.359] GetLastError () returned 0x12 [0047.359] FindNextFileW (in: hFindFile=0x9f60a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d4e74, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb320aac5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1 [0047.359] GetLastError () returned 0x12 [0047.359] FindNextFileW (in: hFindFile=0x9f60a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a90a48, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender Advanced Threat Protection", cAlternateFileName="WIF4A9~1")) returned 1 [0047.359] GetLastError () returned 0x12 [0047.360] FindNextFileW (in: hFindFile=0x9f60a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a928fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~2")) returned 1 [0047.360] GetLastError () returned 0x12 [0047.360] FindNextFileW (in: hFindFile=0x9f60a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a93496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~3")) returned 1 [0047.360] GetLastError () returned 0x12 [0047.360] FindNextFileW (in: hFindFile=0x9f60a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0ef6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Security Health", cAlternateFileName="WINDOW~4")) returned 1 [0047.360] GetLastError () returned 0x12 [0047.360] FindNextFileW (in: hFindFile=0x9f60a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbef9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMSIPC", cAlternateFileName="")) returned 1 [0047.360] GetLastError () returned 0x12 [0047.360] FindNextFileW (in: hFindFile=0x9f60a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 1 [0047.360] GetLastError () returned 0x12 [0047.360] FindNextFileW (in: hFindFile=0x9f60a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 0 [0047.360] GetLastError () returned 0x12 [0047.361] FindClose (in: hFindFile=0x9f60a0 | out: hFindFile=0x9f60a0) returned 1 [0047.361] SetErrorMode (uMode=0x0) returned 0x1 [0047.361] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\AppV", nBufferLength=0x105, lpBuffer=0x8fe508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\AppV", lpFilePart=0x0) returned 0x21 [0047.361] GetLastError () returned 0x12 [0047.361] SetErrorMode (uMode=0x1) returned 0x0 [0047.361] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\AppV\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d3d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6560 [0047.361] GetLastError () returned 0x12 [0047.361] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d3d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.361] GetLastError () returned 0x12 [0047.361] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup", cAlternateFileName="")) returned 1 [0047.361] GetLastError () returned 0x12 [0047.361] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup", cAlternateFileName="")) returned 0 [0047.362] GetLastError () returned 0x12 [0047.362] FindClose (in: hFindFile=0x9f6560 | out: hFindFile=0x9f6560) returned 1 [0047.362] SetErrorMode (uMode=0x0) returned 0x1 [0047.362] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\AppV", nBufferLength=0x105, lpBuffer=0x8fe508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\AppV", lpFilePart=0x0) returned 0x21 [0047.362] GetLastError () returned 0x12 [0047.362] SetErrorMode (uMode=0x1) returned 0x0 [0047.362] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\AppV\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d3d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6660 [0047.362] GetLastError () returned 0x12 [0047.362] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d3d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.362] GetLastError () returned 0x12 [0047.362] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup", cAlternateFileName="")) returned 1 [0047.362] GetLastError () returned 0x12 [0047.362] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup", cAlternateFileName="")) returned 0 [0047.362] GetLastError () returned 0x12 [0047.363] FindClose (in: hFindFile=0x9f6660 | out: hFindFile=0x9f6660) returned 1 [0047.363] SetErrorMode (uMode=0x0) returned 0x1 [0047.363] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\AppV\\Setup", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\AppV\\Setup", lpFilePart=0x0) returned 0x27 [0047.363] GetLastError () returned 0x12 [0047.363] SetErrorMode (uMode=0x1) returned 0x0 [0047.363] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\AppV\\Setup\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f61a0 [0047.364] GetLastError () returned 0x12 [0047.364] FindNextFileW (in: hFindFile=0x9f61a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.364] GetLastError () returned 0x12 [0047.364] FindNextFileW (in: hFindFile=0x9f61a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799dd27b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe2889e45, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe2889e45, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1368, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeIntegrator.ps1", cAlternateFileName="")) returned 1 [0047.364] GetLastError () returned 0x12 [0047.364] FindNextFileW (in: hFindFile=0x9f61a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799dd27b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe2889e45, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe2889e45, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1368, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeIntegrator.ps1", cAlternateFileName="")) returned 0 [0047.364] GetLastError () returned 0x12 [0047.364] FindClose (in: hFindFile=0x9f61a0 | out: hFindFile=0x9f61a0) returned 1 [0047.364] SetErrorMode (uMode=0x0) returned 0x1 [0047.365] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\AppV\\Setup", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\AppV\\Setup", lpFilePart=0x0) returned 0x27 [0047.365] GetLastError () returned 0x12 [0047.365] SetErrorMode (uMode=0x1) returned 0x0 [0047.365] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\AppV\\Setup\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f63a0 [0047.365] GetLastError () returned 0x12 [0047.370] FindNextFileW (in: hFindFile=0x9f63a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.370] GetLastError () returned 0x12 [0047.370] FindNextFileW (in: hFindFile=0x9f63a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799dd27b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe2889e45, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe2889e45, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1368, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeIntegrator.ps1", cAlternateFileName="")) returned 1 [0047.370] GetLastError () returned 0x12 [0047.370] FindNextFileW (in: hFindFile=0x9f63a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799dd27b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe2889e45, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe2889e45, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1368, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeIntegrator.ps1", cAlternateFileName="")) returned 0 [0047.370] GetLastError () returned 0x12 [0047.371] FindClose (in: hFindFile=0x9f63a0 | out: hFindFile=0x9f63a0) returned 1 [0047.371] SetErrorMode (uMode=0x0) returned 0x1 [0047.371] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\AppV\\Setup\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\AppV\\Setup\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x3a [0047.371] GetLastError () returned 0x12 [0047.371] SetErrorMode (uMode=0x1) returned 0x0 [0047.371] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\AppV\\Setup\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\appv\\setup\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x440 [0047.372] GetLastError () returned 0x0 [0047.372] GetFileType (hFile=0x440) returned 0x1 [0047.372] SetErrorMode (uMode=0x0) returned 0x1 [0047.372] GetFileType (hFile=0x440) returned 0x1 [0047.372] WriteFile (in: hFile=0x440, lpBuffer=0x2abe548*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe968, lpOverlapped=0x0 | out: lpBuffer=0x2abe548*, lpNumberOfBytesWritten=0x8fe968*=0xbcb, lpOverlapped=0x0) returned 1 [0047.373] GetLastError () returned 0x0 [0047.373] CloseHandle (hObject=0x440) returned 1 [0047.374] GetLastError () returned 0x0 [0047.374] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\AppV\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\AppV\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x34 [0047.375] GetLastError () returned 0x0 [0047.375] SetErrorMode (uMode=0x1) returned 0x0 [0047.375] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\AppV\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\appv\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x440 [0047.375] GetLastError () returned 0x0 [0047.375] GetFileType (hFile=0x440) returned 0x1 [0047.375] SetErrorMode (uMode=0x0) returned 0x1 [0047.375] GetFileType (hFile=0x440) returned 0x1 [0047.375] WriteFile (in: hFile=0x440, lpBuffer=0x2ac5204*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe99c, lpOverlapped=0x0 | out: lpBuffer=0x2ac5204*, lpNumberOfBytesWritten=0x8fe99c*=0xbcb, lpOverlapped=0x0) returned 1 [0047.376] GetLastError () returned 0x0 [0047.376] CloseHandle (hObject=0x440) returned 1 [0047.377] GetLastError () returned 0x0 [0047.377] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun", nBufferLength=0x105, lpBuffer=0x8fe508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun", lpFilePart=0x0) returned 0x27 [0047.377] GetLastError () returned 0x0 [0047.377] SetErrorMode (uMode=0x1) returned 0x0 [0047.377] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c2b2f4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3c4413a9, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c4413a9, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f61a0 [0047.377] GetLastError () returned 0x0 [0047.377] FindNextFileW (in: hFindFile=0x9f61a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c2b2f4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3c4413a9, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c4413a9, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.377] GetLastError () returned 0x0 [0047.377] FindNextFileW (in: hFindFile=0x9f61a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", cAlternateFileName="0D0D4E~1")) returned 1 [0047.377] GetLastError () returned 0x0 [0047.378] FindNextFileW (in: hFindFile=0x9f61a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", cAlternateFileName="19B111~1")) returned 1 [0047.378] GetLastError () returned 0x0 [0047.378] FindNextFileW (in: hFindFile=0x9f61a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="201EB7DF-C721-4B8B-9C81-A09DE7F931E6", cAlternateFileName="201EB7~1")) returned 1 [0047.378] GetLastError () returned 0x0 [0047.378] FindNextFileW (in: hFindFile=0x9f61a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3dbb3c9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8512127a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8512127a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfig.0.xml", cAlternateFileName="DEPLOY~1.XML")) returned 1 [0047.378] GetLastError () returned 0x0 [0047.378] FindNextFileW (in: hFindFile=0x9f61a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b22dc95, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa011b19, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfa011b19, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x7b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfig.1.xml", cAlternateFileName="DEPLOY~3.XML")) returned 1 [0047.378] GetLastError () returned 0x0 [0047.378] FindNextFileW (in: hFindFile=0x9f61a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x534ee362, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3c4413a9, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c4413a9, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfig.2.xml", cAlternateFileName="DEPLOY~2.XML")) returned 1 [0047.378] GetLastError () returned 0x0 [0047.378] FindNextFileW (in: hFindFile=0x9f61a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineData", cAlternateFileName="MACHIN~1")) returned 1 [0047.378] GetLastError () returned 0x0 [0047.378] FindNextFileW (in: hFindFile=0x9f61a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8826bb5f, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x683c4eba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x683c4eba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProductReleases", cAlternateFileName="PRODUC~1")) returned 1 [0047.379] GetLastError () returned 0x0 [0047.379] FindNextFileW (in: hFindFile=0x9f61a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserData", cAlternateFileName="")) returned 1 [0047.379] GetLastError () returned 0x0 [0047.379] FindNextFileW (in: hFindFile=0x9f61a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47e8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 1 [0047.379] GetLastError () returned 0x0 [0047.379] FindNextFileW (in: hFindFile=0x9f61a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47e8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 0 [0047.379] GetLastError () returned 0x12 [0047.379] FindClose (in: hFindFile=0x9f61a0 | out: hFindFile=0x9f61a0) returned 1 [0047.379] SetErrorMode (uMode=0x0) returned 0x1 [0047.380] GetProcessWindowStation () returned 0x13c [0047.397] GetActiveWindow () returned 0x7002e [0047.397] GetCurrentActCtx (in: lphActCtx=0x8fe958 | out: lphActCtx=0x8fe958*=0x9f8cbc) returned 1 [0047.397] GetCurrentThreadId () returned 0x540 [0047.398] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c1132, lParam=0x0) returned 1 [0047.398] IsWindowVisible (hWnd=0x7002e) returned 0 [0047.398] IsWindowVisible (hWnd=0x4020e) returned 0 [0047.398] IsWindowVisible (hWnd=0x60044) returned 0 [0047.398] IsWindowVisible (hWnd=0x2021a) returned 0 [0047.398] IsWindowVisible (hWnd=0x8004a) returned 0 [0047.398] GetActiveWindow () returned 0x7002e [0047.398] GetFocus () returned 0x7002e [0047.398] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0047.399] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0047.400] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0047.400] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0047.401] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0047.401] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0047.401] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0047.408] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x5020c) returned 0x1 [0047.409] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe214) returned 0x0 [0047.409] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe214) returned 0x0 [0047.567] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0047.579] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe01c) returned 0x0 [0047.579] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe01c) returned 0x0 [0047.579] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x5020c) returned 0x1 [0047.580] SetFocus (hWnd=0x7002e) returned 0x5020c [0047.582] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0047.583] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0047.583] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0047.584] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0047.584] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x5020c, lParam=0x0) returned 0x0 [0047.595] IsWindow (hWnd=0x7002e) returned 1 [0047.595] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0047.595] IsWindow (hWnd=0x7002e) returned 1 [0047.595] SetFocus (hWnd=0x7002e) returned 0x7002e [0047.595] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0047.595] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0047.595] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0047.596] GetProcessWindowStation () returned 0x13c [0047.596] GetActiveWindow () returned 0x7002e [0047.596] GetCurrentActCtx (in: lphActCtx=0x8fe958 | out: lphActCtx=0x8fe958*=0x9f8cbc) returned 1 [0047.596] GetCurrentThreadId () returned 0x540 [0047.596] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c1162, lParam=0x0) returned 1 [0047.596] IsWindowVisible (hWnd=0x7002e) returned 0 [0047.596] IsWindowVisible (hWnd=0x4020e) returned 0 [0047.596] IsWindowVisible (hWnd=0x60044) returned 0 [0047.596] IsWindowVisible (hWnd=0x2021a) returned 0 [0047.596] IsWindowVisible (hWnd=0x8004a) returned 0 [0047.596] GetActiveWindow () returned 0x7002e [0047.597] GetFocus () returned 0x7002e [0047.597] MessageBoxW (hWnd=0x7002e, lpText="kl3sFeYr4Zr2HYTlAkD56g==", lpCaption="", uType=0x0) returned 1 [0047.598] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0047.598] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0047.599] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0047.599] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0047.599] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0047.602] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0047.609] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x6020c) returned 0x1 [0047.610] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe214) returned 0x0 [0047.610] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe214) returned 0x0 [0047.759] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0047.766] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe01c) returned 0x0 [0047.766] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe01c) returned 0x0 [0047.766] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x6020c) returned 0x1 [0047.767] SetFocus (hWnd=0x7002e) returned 0x6020c [0047.769] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0047.770] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0047.770] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0047.771] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0047.771] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x6020c, lParam=0x0) returned 0x0 [0047.779] IsWindow (hWnd=0x7002e) returned 1 [0047.779] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0047.779] IsWindow (hWnd=0x7002e) returned 1 [0047.779] SetFocus (hWnd=0x7002e) returned 0x7002e [0047.779] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0047.779] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0047.779] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0047.779] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml", nBufferLength=0x105, lpBuffer=0x8fe554, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml", lpFilePart=0x0) returned 0x3e [0047.779] GetLastError () returned 0x0 [0047.779] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml", dwFileAttributes=0x80) returned 1 [0047.780] GetLastError () returned 0x0 [0047.780] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml", nBufferLength=0x105, lpBuffer=0x8fe424, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml", lpFilePart=0x0) returned 0x3e [0047.780] GetLastError () returned 0x0 [0047.780] SetErrorMode (uMode=0x1) returned 0x0 [0047.780] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.0.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0047.780] GetLastError () returned 0x0 [0047.780] GetFileType (hFile=0x440) returned 0x1 [0047.780] SetErrorMode (uMode=0x0) returned 0x1 [0047.780] GetFileType (hFile=0x440) returned 0x1 [0047.780] GetFileSize (in: hFile=0x440, lpFileSizeHigh=0x8fe9d8 | out: lpFileSizeHigh=0x8fe9d8*=0x0) returned 0x7b6 [0047.781] GetLastError () returned 0x0 [0047.781] ReadFile (in: hFile=0x440, lpBuffer=0x2ac92bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe980, lpOverlapped=0x0 | out: lpBuffer=0x2ac92bc*, lpNumberOfBytesRead=0x8fe980*=0x7b6, lpOverlapped=0x0) returned 1 [0047.782] GetLastError () returned 0x0 [0047.783] CloseHandle (hObject=0x440) returned 1 [0047.783] GetLastError () returned 0x0 [0047.783] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0047.783] GetLastError () returned 0x0 [0047.783] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe928 | out: phKey=0x8fe928*=0x9f63a0) returned 1 [0047.783] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0047.783] GetLastError () returned 0x0 [0047.783] CryptSetKeyParam (hKey=0x9f63a0, dwParam=0x4, pbData=0x2aca330*=0x1, dwFlags=0x0) returned 1 [0047.783] GetLastError () returned 0x0 [0047.783] CryptSetKeyParam (hKey=0x9f63a0, dwParam=0x1, pbData=0x2aca2fc, dwFlags=0x0) returned 1 [0047.783] GetLastError () returned 0x0 [0047.783] CryptEncrypt (in: hKey=0x9f63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2aca340*, pdwDataLen=0x8fe9e0*=0x7c0, dwBufLen=0x7c0 | out: pbData=0x2aca340*, pdwDataLen=0x8fe9e0*=0x7c0) returned 1 [0047.783] GetLastError () returned 0x0 [0047.783] CryptEncrypt (in: hKey=0x9f63a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2acab20*, pdwDataLen=0x8fe9e8*=0x0, dwBufLen=0x10 | out: pbData=0x2acab20*, pdwDataLen=0x8fe9e8*=0x10) returned 1 [0047.783] GetLastError () returned 0x0 [0047.784] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml", nBufferLength=0x105, lpBuffer=0x8fe42c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml", lpFilePart=0x0) returned 0x3e [0047.784] GetLastError () returned 0x0 [0047.784] SetErrorMode (uMode=0x1) returned 0x0 [0047.784] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.0.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0047.785] GetLastError () returned 0xb7 [0047.785] GetFileType (hFile=0x440) returned 0x1 [0047.785] SetErrorMode (uMode=0x0) returned 0x1 [0047.785] GetFileType (hFile=0x440) returned 0x1 [0047.785] WriteFile (in: hFile=0x440, lpBuffer=0x2acaeac*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x8fe954, lpOverlapped=0x0 | out: lpBuffer=0x2acaeac*, lpNumberOfBytesWritten=0x8fe954*=0x7c0, lpOverlapped=0x0) returned 1 [0047.786] GetLastError () returned 0xb7 [0047.786] CloseHandle (hObject=0x440) returned 1 [0047.787] GetLastError () returned 0xb7 [0047.787] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml.kl3sFeYr4Zr2HYTlAkD56g==.bwall", nBufferLength=0x105, lpBuffer=0x8fe42c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml.kl3sFeYr4Zr2HYTlAkD56g==.bwall", lpFilePart=0x0) returned 0x5d [0047.789] GetLastError () returned 0xb7 [0047.789] SetErrorMode (uMode=0x1) returned 0x0 [0047.789] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml.kl3sFeYr4Zr2HYTlAkD56g==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.0.xml.kl3sfeyr4zr2hytlakd56g==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0047.791] GetLastError () returned 0x0 [0047.791] GetFileType (hFile=0x440) returned 0x1 [0047.791] SetErrorMode (uMode=0x0) returned 0x1 [0047.791] GetFileType (hFile=0x440) returned 0x1 [0047.791] WriteFile (in: hFile=0x440, lpBuffer=0x2acc15c*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x8fe954, lpOverlapped=0x0 | out: lpBuffer=0x2acc15c*, lpNumberOfBytesWritten=0x8fe954*=0x7c0, lpOverlapped=0x0) returned 1 [0047.792] GetLastError () returned 0x0 [0047.792] CloseHandle (hObject=0x440) returned 1 [0047.792] GetLastError () returned 0x0 [0047.792] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml", nBufferLength=0x105, lpBuffer=0x8fe550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml", lpFilePart=0x0) returned 0x3e [0047.792] GetLastError () returned 0x0 [0047.792] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.0.xml")) returned 1 [0047.793] GetLastError () returned 0x0 [0047.797] GetProcessWindowStation () returned 0x13c [0047.797] GetActiveWindow () returned 0x7002e [0047.797] GetCurrentActCtx (in: lphActCtx=0x8fe958 | out: lphActCtx=0x8fe958*=0x9f8cbc) returned 1 [0047.797] GetCurrentThreadId () returned 0x540 [0047.797] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c1192, lParam=0x0) returned 1 [0047.797] IsWindowVisible (hWnd=0x7002e) returned 0 [0047.797] IsWindowVisible (hWnd=0x4020e) returned 0 [0047.797] IsWindowVisible (hWnd=0x60044) returned 0 [0047.797] IsWindowVisible (hWnd=0x2021a) returned 0 [0047.797] IsWindowVisible (hWnd=0x8004a) returned 0 [0047.797] GetActiveWindow () returned 0x7002e [0047.798] GetFocus () returned 0x7002e [0047.798] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0047.798] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0047.799] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0047.800] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0047.800] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0047.800] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0047.804] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0047.811] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x7020c) returned 0x1 [0047.812] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe214) returned 0x0 [0047.812] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe214) returned 0x0 [0047.981] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0047.989] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe01c) returned 0x0 [0047.989] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe01c) returned 0x0 [0047.989] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x7020c) returned 0x1 [0047.993] SetFocus (hWnd=0x7002e) returned 0x7020c [0047.995] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0047.996] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0047.996] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0047.997] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0047.997] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x7020c, lParam=0x0) returned 0x0 [0048.001] IsWindow (hWnd=0x7002e) returned 1 [0048.001] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0048.001] IsWindow (hWnd=0x7002e) returned 1 [0048.001] SetFocus (hWnd=0x7002e) returned 0x7002e [0048.002] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0048.002] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0048.002] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0048.002] GetProcessWindowStation () returned 0x13c [0048.002] GetActiveWindow () returned 0x7002e [0048.002] GetCurrentActCtx (in: lphActCtx=0x8fe958 | out: lphActCtx=0x8fe958*=0x9f8cbc) returned 1 [0048.002] GetCurrentThreadId () returned 0x540 [0048.003] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c11c2, lParam=0x0) returned 1 [0048.003] IsWindowVisible (hWnd=0x7002e) returned 0 [0048.003] IsWindowVisible (hWnd=0x4020e) returned 0 [0048.003] IsWindowVisible (hWnd=0x60044) returned 0 [0048.003] IsWindowVisible (hWnd=0x2021a) returned 0 [0048.003] IsWindowVisible (hWnd=0x8004a) returned 0 [0048.003] GetActiveWindow () returned 0x7002e [0048.003] GetFocus () returned 0x7002e [0048.003] MessageBoxW (hWnd=0x7002e, lpText="axVYVu1kXlk9hZb1JJfrlw==", lpCaption="", uType=0x0) returned 1 [0048.004] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0048.005] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0048.005] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0048.006] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0048.006] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0048.008] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0048.014] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x8020c) returned 0x1 [0048.015] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe214) returned 0x0 [0048.015] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe214) returned 0x0 [0048.220] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0048.230] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe01c) returned 0x0 [0048.230] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe01c) returned 0x0 [0048.230] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x8020c) returned 0x1 [0048.232] SetFocus (hWnd=0x7002e) returned 0x8020c [0048.233] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0048.235] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0048.235] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0048.235] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0048.235] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x8020c, lParam=0x0) returned 0x0 [0048.239] IsWindow (hWnd=0x7002e) returned 1 [0048.239] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0048.239] IsWindow (hWnd=0x7002e) returned 1 [0048.239] SetFocus (hWnd=0x7002e) returned 0x7002e [0048.239] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0048.240] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0048.240] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0048.240] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml", nBufferLength=0x105, lpBuffer=0x8fe554, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml", lpFilePart=0x0) returned 0x3e [0048.240] GetLastError () returned 0x0 [0048.240] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml", dwFileAttributes=0x80) returned 1 [0048.241] GetLastError () returned 0x0 [0048.241] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml", nBufferLength=0x105, lpBuffer=0x8fe424, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml", lpFilePart=0x0) returned 0x3e [0048.241] GetLastError () returned 0x0 [0048.241] SetErrorMode (uMode=0x1) returned 0x0 [0048.241] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.1.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0048.241] GetLastError () returned 0x0 [0048.241] GetFileType (hFile=0x440) returned 0x1 [0048.241] SetErrorMode (uMode=0x0) returned 0x1 [0048.242] GetFileType (hFile=0x440) returned 0x1 [0048.242] GetFileSize (in: hFile=0x440, lpFileSizeHigh=0x8fe9d8 | out: lpFileSizeHigh=0x8fe9d8*=0x0) returned 0x7b4 [0048.242] GetLastError () returned 0x0 [0048.242] ReadFile (in: hFile=0x440, lpBuffer=0x2ad25ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe980, lpOverlapped=0x0 | out: lpBuffer=0x2ad25ac*, lpNumberOfBytesRead=0x8fe980*=0x7b4, lpOverlapped=0x0) returned 1 [0048.244] GetLastError () returned 0x0 [0048.244] CloseHandle (hObject=0x440) returned 1 [0048.244] GetLastError () returned 0x0 [0048.244] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0048.244] GetLastError () returned 0x0 [0048.244] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe928 | out: phKey=0x8fe928*=0x9f6220) returned 1 [0048.244] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0048.244] GetLastError () returned 0x0 [0048.244] CryptSetKeyParam (hKey=0x9f6220, dwParam=0x4, pbData=0x2ad3620*=0x1, dwFlags=0x0) returned 1 [0048.244] GetLastError () returned 0x0 [0048.244] CryptSetKeyParam (hKey=0x9f6220, dwParam=0x1, pbData=0x2ad35ec, dwFlags=0x0) returned 1 [0048.244] GetLastError () returned 0x0 [0048.245] CryptEncrypt (in: hKey=0x9f6220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2ad3630*, pdwDataLen=0x8fe9e0*=0x7c0, dwBufLen=0x7c0 | out: pbData=0x2ad3630*, pdwDataLen=0x8fe9e0*=0x7c0) returned 1 [0048.245] GetLastError () returned 0x0 [0048.245] CryptEncrypt (in: hKey=0x9f6220, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ad3e10*, pdwDataLen=0x8fe9e8*=0x0, dwBufLen=0x10 | out: pbData=0x2ad3e10*, pdwDataLen=0x8fe9e8*=0x10) returned 1 [0048.245] GetLastError () returned 0x0 [0048.245] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml", nBufferLength=0x105, lpBuffer=0x8fe42c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml", lpFilePart=0x0) returned 0x3e [0048.245] GetLastError () returned 0x0 [0048.245] SetErrorMode (uMode=0x1) returned 0x0 [0048.245] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.1.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0048.246] GetLastError () returned 0xb7 [0048.246] GetFileType (hFile=0x440) returned 0x1 [0048.246] SetErrorMode (uMode=0x0) returned 0x1 [0048.246] GetFileType (hFile=0x440) returned 0x1 [0048.246] WriteFile (in: hFile=0x440, lpBuffer=0x2ad419c*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x8fe954, lpOverlapped=0x0 | out: lpBuffer=0x2ad419c*, lpNumberOfBytesWritten=0x8fe954*=0x7c0, lpOverlapped=0x0) returned 1 [0048.247] GetLastError () returned 0xb7 [0048.247] CloseHandle (hObject=0x440) returned 1 [0048.248] GetLastError () returned 0xb7 [0048.248] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml.axVYVu1kXlk9hZb1JJfrlw==.bwall", nBufferLength=0x105, lpBuffer=0x8fe42c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml.axVYVu1kXlk9hZb1JJfrlw==.bwall", lpFilePart=0x0) returned 0x5d [0048.248] GetLastError () returned 0xb7 [0048.248] SetErrorMode (uMode=0x1) returned 0x0 [0048.248] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml.axVYVu1kXlk9hZb1JJfrlw==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.1.xml.axvyvu1kxlk9hzb1jjfrlw==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0048.249] GetLastError () returned 0x0 [0048.249] GetFileType (hFile=0x440) returned 0x1 [0048.249] SetErrorMode (uMode=0x0) returned 0x1 [0048.249] GetFileType (hFile=0x440) returned 0x1 [0048.249] WriteFile (in: hFile=0x440, lpBuffer=0x2ad544c*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x8fe954, lpOverlapped=0x0 | out: lpBuffer=0x2ad544c*, lpNumberOfBytesWritten=0x8fe954*=0x7c0, lpOverlapped=0x0) returned 1 [0048.250] GetLastError () returned 0x0 [0048.250] CloseHandle (hObject=0x440) returned 1 [0048.250] GetLastError () returned 0x0 [0048.250] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml", nBufferLength=0x105, lpBuffer=0x8fe550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml", lpFilePart=0x0) returned 0x3e [0048.250] GetLastError () returned 0x0 [0048.250] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.1.xml")) returned 1 [0048.251] GetLastError () returned 0x0 [0048.252] GetProcessWindowStation () returned 0x13c [0048.252] GetActiveWindow () returned 0x7002e [0048.252] GetCurrentActCtx (in: lphActCtx=0x8fe958 | out: lphActCtx=0x8fe958*=0x9f8cbc) returned 1 [0048.252] GetCurrentThreadId () returned 0x540 [0048.252] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c11f2, lParam=0x0) returned 1 [0048.252] IsWindowVisible (hWnd=0x7002e) returned 0 [0048.252] IsWindowVisible (hWnd=0x4020e) returned 0 [0048.252] IsWindowVisible (hWnd=0x60044) returned 0 [0048.252] IsWindowVisible (hWnd=0x2021a) returned 0 [0048.252] IsWindowVisible (hWnd=0x8004a) returned 0 [0048.252] GetActiveWindow () returned 0x7002e [0048.252] GetFocus () returned 0x7002e [0048.253] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0048.253] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0048.254] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0048.255] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0048.255] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0048.255] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0048.261] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0048.269] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x9020c) returned 0x1 [0048.269] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe214) returned 0x0 [0048.270] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe214) returned 0x0 [0048.392] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0048.401] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe01c) returned 0x0 [0048.401] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe01c) returned 0x0 [0048.401] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x9020c) returned 0x1 [0048.402] SetFocus (hWnd=0x7002e) returned 0x9020c [0048.404] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0048.405] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0048.405] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0048.406] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0048.406] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x9020c, lParam=0x0) returned 0x0 [0048.411] IsWindow (hWnd=0x7002e) returned 1 [0048.411] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0048.411] IsWindow (hWnd=0x7002e) returned 1 [0048.411] SetFocus (hWnd=0x7002e) returned 0x7002e [0048.411] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0048.411] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0048.411] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0048.412] GetProcessWindowStation () returned 0x13c [0048.412] GetActiveWindow () returned 0x7002e [0048.412] GetCurrentActCtx (in: lphActCtx=0x8fe958 | out: lphActCtx=0x8fe958*=0x9f8cbc) returned 1 [0048.412] GetCurrentThreadId () returned 0x540 [0048.419] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c1222, lParam=0x0) returned 1 [0048.419] IsWindowVisible (hWnd=0x7002e) returned 0 [0048.419] IsWindowVisible (hWnd=0x4020e) returned 0 [0048.419] IsWindowVisible (hWnd=0x60044) returned 0 [0048.419] IsWindowVisible (hWnd=0x2021a) returned 0 [0048.419] IsWindowVisible (hWnd=0x8004a) returned 0 [0048.419] GetActiveWindow () returned 0x7002e [0048.419] GetFocus () returned 0x7002e [0048.419] MessageBoxW (hWnd=0x7002e, lpText="+evRQth+rDD/snoChqbOxw==", lpCaption="", uType=0x0) returned 1 [0048.420] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0048.421] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0048.421] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0048.422] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0048.422] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0048.422] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0048.442] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0xa020c) returned 0x1 [0048.445] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe214) returned 0x0 [0048.445] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe214) returned 0x0 [0048.577] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0048.587] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe01c) returned 0x0 [0048.587] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe01c) returned 0x0 [0048.587] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0xa020c) returned 0x1 [0048.588] SetFocus (hWnd=0x7002e) returned 0xa020c [0048.590] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0048.591] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0048.591] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0048.592] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0048.592] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0xa020c, lParam=0x0) returned 0x0 [0048.596] IsWindow (hWnd=0x7002e) returned 1 [0048.596] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0048.596] IsWindow (hWnd=0x7002e) returned 1 [0048.596] SetFocus (hWnd=0x7002e) returned 0x7002e [0048.596] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0048.596] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0048.596] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0048.597] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml", nBufferLength=0x105, lpBuffer=0x8fe554, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml", lpFilePart=0x0) returned 0x3e [0048.597] GetLastError () returned 0x0 [0048.597] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml", dwFileAttributes=0x80) returned 1 [0048.598] GetLastError () returned 0x0 [0048.598] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml", nBufferLength=0x105, lpBuffer=0x8fe424, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml", lpFilePart=0x0) returned 0x3e [0048.598] GetLastError () returned 0x0 [0048.598] SetErrorMode (uMode=0x1) returned 0x0 [0048.598] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.2.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0048.598] GetLastError () returned 0x0 [0048.598] GetFileType (hFile=0x440) returned 0x1 [0048.598] SetErrorMode (uMode=0x0) returned 0x1 [0048.598] GetFileType (hFile=0x440) returned 0x1 [0048.599] GetFileSize (in: hFile=0x440, lpFileSizeHigh=0x8fe9d8 | out: lpFileSizeHigh=0x8fe9d8*=0x0) returned 0x566 [0048.599] GetLastError () returned 0x0 [0048.599] ReadFile (in: hFile=0x440, lpBuffer=0x2adb650, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe980, lpOverlapped=0x0 | out: lpBuffer=0x2adb650*, lpNumberOfBytesRead=0x8fe980*=0x566, lpOverlapped=0x0) returned 1 [0048.607] GetLastError () returned 0x0 [0048.607] CloseHandle (hObject=0x440) returned 1 [0048.607] GetLastError () returned 0x0 [0048.607] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0048.607] GetLastError () returned 0x0 [0048.607] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe928 | out: phKey=0x8fe928*=0x9f60a0) returned 1 [0048.607] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0048.607] GetLastError () returned 0x0 [0048.607] CryptSetKeyParam (hKey=0x9f60a0, dwParam=0x4, pbData=0x2adc6c4*=0x1, dwFlags=0x0) returned 1 [0048.607] GetLastError () returned 0x0 [0048.607] CryptSetKeyParam (hKey=0x9f60a0, dwParam=0x1, pbData=0x2adc690, dwFlags=0x0) returned 1 [0048.607] GetLastError () returned 0x0 [0048.608] CryptEncrypt (in: hKey=0x9f60a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2adc6d4*, pdwDataLen=0x8fe9e0*=0x570, dwBufLen=0x570 | out: pbData=0x2adc6d4*, pdwDataLen=0x8fe9e0*=0x570) returned 1 [0048.608] GetLastError () returned 0x0 [0048.608] CryptEncrypt (in: hKey=0x9f60a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2adcc64*, pdwDataLen=0x8fe9e8*=0x0, dwBufLen=0x10 | out: pbData=0x2adcc64*, pdwDataLen=0x8fe9e8*=0x10) returned 1 [0048.608] GetLastError () returned 0x0 [0048.608] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml", nBufferLength=0x105, lpBuffer=0x8fe42c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml", lpFilePart=0x0) returned 0x3e [0048.608] GetLastError () returned 0x0 [0048.608] SetErrorMode (uMode=0x1) returned 0x0 [0048.608] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.2.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0048.609] GetLastError () returned 0xb7 [0048.609] GetFileType (hFile=0x440) returned 0x1 [0048.609] SetErrorMode (uMode=0x0) returned 0x1 [0048.609] GetFileType (hFile=0x440) returned 0x1 [0048.609] WriteFile (in: hFile=0x440, lpBuffer=0x2add034*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x8fe954, lpOverlapped=0x0 | out: lpBuffer=0x2add034*, lpNumberOfBytesWritten=0x8fe954*=0x570, lpOverlapped=0x0) returned 1 [0048.610] GetLastError () returned 0xb7 [0048.610] CloseHandle (hObject=0x440) returned 1 [0048.611] GetLastError () returned 0xb7 [0048.611] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml.+evRQth+rDD#snoChqbOxw==.bwall", nBufferLength=0x105, lpBuffer=0x8fe42c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml.+evRQth+rDD#snoChqbOxw==.bwall", lpFilePart=0x0) returned 0x5d [0048.611] GetLastError () returned 0xb7 [0048.611] SetErrorMode (uMode=0x1) returned 0x0 [0048.612] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml.+evRQth+rDD#snoChqbOxw==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.2.xml.+evrqth+rdd#snochqboxw==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0048.612] GetLastError () returned 0x0 [0048.612] GetFileType (hFile=0x440) returned 0x1 [0048.612] SetErrorMode (uMode=0x0) returned 0x1 [0048.612] GetFileType (hFile=0x440) returned 0x1 [0048.612] WriteFile (in: hFile=0x440, lpBuffer=0x2ade2e4*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x8fe954, lpOverlapped=0x0 | out: lpBuffer=0x2ade2e4*, lpNumberOfBytesWritten=0x8fe954*=0x570, lpOverlapped=0x0) returned 1 [0048.632] GetLastError () returned 0x0 [0048.632] CloseHandle (hObject=0x440) returned 1 [0048.632] GetLastError () returned 0x0 [0048.632] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml", nBufferLength=0x105, lpBuffer=0x8fe550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml", lpFilePart=0x0) returned 0x3e [0048.632] GetLastError () returned 0x0 [0048.633] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.2.xml")) returned 1 [0048.633] GetLastError () returned 0x0 [0048.634] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun", nBufferLength=0x105, lpBuffer=0x8fe508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun", lpFilePart=0x0) returned 0x27 [0048.634] GetLastError () returned 0x0 [0048.635] SetErrorMode (uMode=0x1) returned 0x0 [0048.635] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c2b2f4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3c4413a9, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0xcc5b713d, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f60e0 [0048.635] GetLastError () returned 0x0 [0048.635] FindNextFileW (in: hFindFile=0x9f60e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c2b2f4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3c4413a9, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0xcc5b713d, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.635] GetLastError () returned 0x0 [0048.635] FindNextFileW (in: hFindFile=0x9f60e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", cAlternateFileName="0D0D4E~1")) returned 1 [0048.635] GetLastError () returned 0x0 [0048.636] FindNextFileW (in: hFindFile=0x9f60e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", cAlternateFileName="19B111~1")) returned 1 [0048.636] GetLastError () returned 0x0 [0048.636] FindNextFileW (in: hFindFile=0x9f60e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="201EB7DF-C721-4B8B-9C81-A09DE7F931E6", cAlternateFileName="201EB7~1")) returned 1 [0048.636] GetLastError () returned 0x0 [0048.636] FindNextFileW (in: hFindFile=0x9f60e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbdab31a, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xcbdab31a, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xcbdab31a, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x7c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfig.0.xml.kl3sFeYr4Zr2HYTlAkD56g==.bwall", cAlternateFileName="DEPLOY~1.BWA")) returned 1 [0048.636] GetLastError () returned 0x0 [0048.636] FindNextFileW (in: hFindFile=0x9f60e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1fd642, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xcc1fd642, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xcc1fd642, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x7c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfig.1.xml.axVYVu1kXlk9hZb1JJfrlw==.bwall", cAlternateFileName="DEPLOY~2.BWA")) returned 1 [0048.636] GetLastError () returned 0x0 [0048.636] FindNextFileW (in: hFindFile=0x9f60e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc56ac89, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xcc56ac89, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xcc5b713d, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x570, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfig.2.xml.+evRQth+rDD#snoChqbOxw==.bwall", cAlternateFileName="DEPLOY~3.BWA")) returned 1 [0048.637] GetLastError () returned 0x0 [0048.637] FindNextFileW (in: hFindFile=0x9f60e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineData", cAlternateFileName="MACHIN~1")) returned 1 [0048.637] GetLastError () returned 0x0 [0048.637] FindNextFileW (in: hFindFile=0x9f60e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8826bb5f, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x683c4eba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x683c4eba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProductReleases", cAlternateFileName="PRODUC~1")) returned 1 [0048.637] GetLastError () returned 0x0 [0048.637] FindNextFileW (in: hFindFile=0x9f60e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserData", cAlternateFileName="")) returned 1 [0048.637] GetLastError () returned 0x0 [0048.637] FindNextFileW (in: hFindFile=0x9f60e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47e8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 1 [0048.637] GetLastError () returned 0x0 [0048.638] FindNextFileW (in: hFindFile=0x9f60e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47e8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 0 [0048.638] GetLastError () returned 0x12 [0048.638] FindClose (in: hFindFile=0x9f60e0 | out: hFindFile=0x9f60e0) returned 1 [0048.638] SetErrorMode (uMode=0x0) returned 0x1 [0048.638] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", lpFilePart=0x0) returned 0x4c [0048.638] GetLastError () returned 0x12 [0048.638] SetErrorMode (uMode=0x1) returned 0x0 [0048.638] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f67a0 [0048.639] GetLastError () returned 0x12 [0048.639] FindNextFileW (in: hFindFile=0x9f67a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.639] GetLastError () returned 0x12 [0048.639] FindNextFileW (in: hFindFile=0x9f67a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1 [0048.639] GetLastError () returned 0x12 [0048.640] FindNextFileW (in: hFindFile=0x9f67a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a5650a, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0048.640] GetLastError () returned 0x12 [0048.640] FindNextFileW (in: hFindFile=0x9f67a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a5650a, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0048.640] GetLastError () returned 0x12 [0048.640] FindClose (in: hFindFile=0x9f67a0 | out: hFindFile=0x9f67a0) returned 1 [0048.640] SetErrorMode (uMode=0x0) returned 0x1 [0048.640] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", lpFilePart=0x0) returned 0x4c [0048.640] GetLastError () returned 0x12 [0048.640] SetErrorMode (uMode=0x1) returned 0x0 [0048.640] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f67e0 [0048.641] GetLastError () returned 0x12 [0048.641] FindNextFileW (in: hFindFile=0x9f67e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.641] GetLastError () returned 0x12 [0048.641] FindNextFileW (in: hFindFile=0x9f67e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1 [0048.641] GetLastError () returned 0x12 [0048.641] FindNextFileW (in: hFindFile=0x9f67e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a5650a, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0048.641] GetLastError () returned 0x12 [0048.641] FindNextFileW (in: hFindFile=0x9f67e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a5650a, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0048.641] GetLastError () returned 0x12 [0048.642] FindClose (in: hFindFile=0x9f67e0 | out: hFindFile=0x9f67e0) returned 1 [0048.642] SetErrorMode (uMode=0x0) returned 0x1 [0048.642] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16", lpFilePart=0x0) returned 0x55 [0048.642] GetLastError () returned 0x12 [0048.642] SetErrorMode (uMode=0x1) returned 0x0 [0048.642] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6760 [0048.643] GetLastError () returned 0x12 [0048.644] FindNextFileW (in: hFindFile=0x9f6760, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.644] GetLastError () returned 0x12 [0048.644] FindNextFileW (in: hFindFile=0x9f6760, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x39768000, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x564f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0048.644] GetLastError () returned 0x12 [0048.644] FindNextFileW (in: hFindFile=0x9f6760, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s641033.hash", cAlternateFileName="S64103~1.HAS")) returned 1 [0048.644] GetLastError () returned 0x12 [0048.644] FindNextFileW (in: hFindFile=0x9f6760, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x3e87ff00, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0048.644] GetLastError () returned 0x12 [0048.645] FindNextFileW (in: hFindFile=0x9f6760, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x3e87ff00, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0048.645] GetLastError () returned 0x12 [0048.645] FindClose (in: hFindFile=0x9f6760 | out: hFindFile=0x9f6760) returned 1 [0048.645] SetErrorMode (uMode=0x0) returned 0x1 [0048.651] GetProcessWindowStation () returned 0x13c [0048.651] GetActiveWindow () returned 0x7002e [0048.651] GetCurrentActCtx (in: lphActCtx=0x8fe8f0 | out: lphActCtx=0x8fe8f0*=0x9f8cbc) returned 1 [0048.652] GetCurrentThreadId () returned 0x540 [0048.652] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c1252, lParam=0x0) returned 1 [0048.652] IsWindowVisible (hWnd=0x7002e) returned 0 [0048.652] IsWindowVisible (hWnd=0x4020e) returned 0 [0048.652] IsWindowVisible (hWnd=0x60044) returned 0 [0048.652] IsWindowVisible (hWnd=0x2021a) returned 0 [0048.652] IsWindowVisible (hWnd=0x8004a) returned 0 [0048.652] GetActiveWindow () returned 0x7002e [0048.653] GetFocus () returned 0x7002e [0048.653] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0048.654] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0048.654] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0048.655] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0048.655] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0048.655] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0048.656] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0048.662] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0xb020c) returned 0x1 [0048.663] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0048.663] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0048.778] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0048.785] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0048.785] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0048.785] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0xb020c) returned 0x1 [0048.786] SetFocus (hWnd=0x7002e) returned 0xb020c [0048.788] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0048.790] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0048.790] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0048.790] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0048.790] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0xb020c, lParam=0x0) returned 0x0 [0048.794] IsWindow (hWnd=0x7002e) returned 1 [0048.794] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0048.794] IsWindow (hWnd=0x7002e) returned 1 [0048.795] SetFocus (hWnd=0x7002e) returned 0x7002e [0048.795] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0048.795] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0048.795] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0048.795] GetProcessWindowStation () returned 0x13c [0048.795] GetActiveWindow () returned 0x7002e [0048.795] GetCurrentActCtx (in: lphActCtx=0x8fe8f0 | out: lphActCtx=0x8fe8f0*=0x9f8cbc) returned 1 [0048.795] GetCurrentThreadId () returned 0x540 [0048.797] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c04ba, lParam=0x0) returned 1 [0048.797] IsWindowVisible (hWnd=0x7002e) returned 0 [0048.797] IsWindowVisible (hWnd=0x4020e) returned 0 [0048.797] IsWindowVisible (hWnd=0x60044) returned 0 [0048.798] IsWindowVisible (hWnd=0x2021a) returned 0 [0048.798] IsWindowVisible (hWnd=0x8004a) returned 0 [0048.798] GetActiveWindow () returned 0x7002e [0048.798] GetFocus () returned 0x7002e [0048.798] MessageBoxW (hWnd=0x7002e, lpText="+DU80cKozbRSo8w6MqeF6A==", lpCaption="", uType=0x0) returned 1 [0048.799] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0048.799] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0048.800] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0048.800] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0048.800] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0048.801] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0048.809] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0xc020c) returned 0x1 [0048.810] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0048.810] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0049.133] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0049.141] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0049.141] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0049.141] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0xc020c) returned 0x1 [0049.142] SetFocus (hWnd=0x7002e) returned 0xc020c [0049.144] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0049.145] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0049.145] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0049.146] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0049.146] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0xc020c, lParam=0x0) returned 0x0 [0049.154] IsWindow (hWnd=0x7002e) returned 1 [0049.154] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0049.154] IsWindow (hWnd=0x7002e) returned 1 [0049.154] SetFocus (hWnd=0x7002e) returned 0x7002e [0049.154] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0049.154] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0049.154] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0049.154] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe4ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml", lpFilePart=0x0) returned 0x70 [0049.154] GetLastError () returned 0x0 [0049.154] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml", dwFileAttributes=0x80) returned 1 [0049.156] GetLastError () returned 0x0 [0049.156] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml", lpFilePart=0x0) returned 0x70 [0049.156] GetLastError () returned 0x0 [0049.156] SetErrorMode (uMode=0x1) returned 0x0 [0049.156] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\masterdescriptor.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0049.156] GetLastError () returned 0x0 [0049.156] GetFileType (hFile=0x440) returned 0x1 [0049.156] SetErrorMode (uMode=0x0) returned 0x1 [0049.156] GetFileType (hFile=0x440) returned 0x1 [0049.156] GetFileSize (in: hFile=0x440, lpFileSizeHigh=0x8fe970 | out: lpFileSizeHigh=0x8fe970*=0x0) returned 0x564f [0049.156] GetLastError () returned 0x0 [0049.157] ReadFile (in: hFile=0x440, lpBuffer=0x2ae7220, nNumberOfBytesToRead=0x564f, lpNumberOfBytesRead=0x8fe918, lpOverlapped=0x0 | out: lpBuffer=0x2ae7220*, lpNumberOfBytesRead=0x8fe918*=0x564f, lpOverlapped=0x0) returned 1 [0049.158] GetLastError () returned 0x0 [0049.158] CloseHandle (hObject=0x440) returned 1 [0049.159] GetLastError () returned 0x0 [0049.159] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0049.159] GetLastError () returned 0x0 [0049.159] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8c0 | out: phKey=0x8fe8c0*=0x9f67e0) returned 1 [0049.159] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0049.159] GetLastError () returned 0x0 [0049.159] CryptSetKeyParam (hKey=0x9f67e0, dwParam=0x4, pbData=0x2aec8e4*=0x1, dwFlags=0x0) returned 1 [0049.159] GetLastError () returned 0x0 [0049.159] CryptSetKeyParam (hKey=0x9f67e0, dwParam=0x1, pbData=0x2aec8b0, dwFlags=0x0) returned 1 [0049.159] GetLastError () returned 0x0 [0049.160] CryptEncrypt (in: hKey=0x9f67e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2aec8f4*, pdwDataLen=0x8fe978*=0x5650, dwBufLen=0x5650 | out: pbData=0x2aec8f4*, pdwDataLen=0x8fe978*=0x5650) returned 1 [0049.160] GetLastError () returned 0x0 [0049.160] CryptEncrypt (in: hKey=0x9f67e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2af1f64*, pdwDataLen=0x8fe980*=0x0, dwBufLen=0x10 | out: pbData=0x2af1f64*, pdwDataLen=0x8fe980*=0x10) returned 1 [0049.160] GetLastError () returned 0x0 [0049.160] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml", lpFilePart=0x0) returned 0x70 [0049.160] GetLastError () returned 0x0 [0049.160] SetErrorMode (uMode=0x1) returned 0x0 [0049.160] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\masterdescriptor.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0049.161] GetLastError () returned 0xb7 [0049.161] GetFileType (hFile=0x440) returned 0x1 [0049.161] SetErrorMode (uMode=0x0) returned 0x1 [0049.161] GetFileType (hFile=0x440) returned 0x1 [0049.162] WriteFile (in: hFile=0x440, lpBuffer=0x2aec8f4*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x8fe924, lpOverlapped=0x0 | out: lpBuffer=0x2aec8f4*, lpNumberOfBytesWritten=0x8fe924*=0x5650, lpOverlapped=0x0) returned 1 [0049.177] GetLastError () returned 0xb7 [0049.177] CloseHandle (hObject=0x440) returned 1 [0049.183] GetLastError () returned 0xb7 [0049.183] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml.+DU80cKozbRSo8w6MqeF6A==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml.+DU80cKozbRSo8w6MqeF6A==.bwall", lpFilePart=0x0) returned 0x8f [0049.183] GetLastError () returned 0xb7 [0049.183] SetErrorMode (uMode=0x1) returned 0x0 [0049.183] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml.+DU80cKozbRSo8w6MqeF6A==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\masterdescriptor.en-us.xml.+du80ckozbrso8w6mqef6a==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0049.184] GetLastError () returned 0x0 [0049.184] GetFileType (hFile=0x440) returned 0x1 [0049.184] SetErrorMode (uMode=0x0) returned 0x1 [0049.184] GetFileType (hFile=0x440) returned 0x1 [0049.184] WriteFile (in: hFile=0x440, lpBuffer=0x2aec8f4*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x8fe924, lpOverlapped=0x0 | out: lpBuffer=0x2aec8f4*, lpNumberOfBytesWritten=0x8fe924*=0x5650, lpOverlapped=0x0) returned 1 [0049.186] GetLastError () returned 0x0 [0049.186] CloseHandle (hObject=0x440) returned 1 [0049.186] GetLastError () returned 0x0 [0049.186] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml", lpFilePart=0x0) returned 0x70 [0049.186] GetLastError () returned 0x0 [0049.187] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\masterdescriptor.en-us.xml")) returned 1 [0049.188] GetLastError () returned 0x0 [0049.192] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16", lpFilePart=0x0) returned 0x55 [0049.192] GetLastError () returned 0x0 [0049.192] SetErrorMode (uMode=0x1) returned 0x0 [0049.192] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xccaee5ca, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f65a0 [0049.192] GetLastError () returned 0x0 [0049.192] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xccaee5ca, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.192] GetLastError () returned 0x0 [0049.192] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccaee5ca, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xccaee5ca, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xccaee5ca, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x5650, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.en-us.xml.+DU80cKozbRSo8w6MqeF6A==.bwall", cAlternateFileName="MASTER~1.BWA")) returned 1 [0049.192] GetLastError () returned 0x0 [0049.193] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s641033.hash", cAlternateFileName="S64103~1.HAS")) returned 1 [0049.193] GetLastError () returned 0x0 [0049.193] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x3e87ff00, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0049.193] GetLastError () returned 0x0 [0049.193] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x3e87ff00, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0049.193] GetLastError () returned 0x12 [0049.193] FindClose (in: hFindFile=0x9f65a0 | out: hFindFile=0x9f65a0) returned 1 [0049.194] SetErrorMode (uMode=0x0) returned 0x1 [0049.195] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe3dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x68 [0049.195] GetLastError () returned 0x12 [0049.195] SetErrorMode (uMode=0x1) returned 0x0 [0049.195] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x440 [0049.196] GetLastError () returned 0x0 [0049.196] GetFileType (hFile=0x440) returned 0x1 [0049.196] SetErrorMode (uMode=0x0) returned 0x1 [0049.196] GetFileType (hFile=0x440) returned 0x1 [0049.196] WriteFile (in: hFile=0x440, lpBuffer=0x2b046a4*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe934, lpOverlapped=0x0 | out: lpBuffer=0x2b046a4*, lpNumberOfBytesWritten=0x8fe934*=0xbcb, lpOverlapped=0x0) returned 1 [0049.197] GetLastError () returned 0x0 [0049.197] CloseHandle (hObject=0x440) returned 1 [0049.197] GetLastError () returned 0x0 [0049.197] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16", lpFilePart=0x0) returned 0x56 [0049.197] GetLastError () returned 0x0 [0049.197] SetErrorMode (uMode=0x1) returned 0x0 [0049.197] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a5650a, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6660 [0049.199] GetLastError () returned 0x0 [0049.199] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a5650a, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.199] GetLastError () returned 0x0 [0049.199] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a09ff9, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a09ff9, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x37142600, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x5211, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0049.199] GetLastError () returned 0x0 [0049.200] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a302bd, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a302bd, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s640.hash", cAlternateFileName="S640~1.HAS")) returned 1 [0049.200] GetLastError () returned 0x0 [0049.200] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a302bd, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a302bd, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0049.200] GetLastError () returned 0x0 [0049.200] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a302bd, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a302bd, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0049.200] GetLastError () returned 0x12 [0049.200] FindClose (in: hFindFile=0x9f6660 | out: hFindFile=0x9f6660) returned 1 [0049.201] SetErrorMode (uMode=0x0) returned 0x1 [0049.201] GetProcessWindowStation () returned 0x13c [0049.201] GetActiveWindow () returned 0x7002e [0049.201] GetCurrentActCtx (in: lphActCtx=0x8fe8f0 | out: lphActCtx=0x8fe8f0*=0x9f8cbc) returned 1 [0049.201] GetCurrentThreadId () returned 0x540 [0049.202] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c41da, lParam=0x0) returned 1 [0049.202] IsWindowVisible (hWnd=0x7002e) returned 0 [0049.203] IsWindowVisible (hWnd=0x4020e) returned 0 [0049.203] IsWindowVisible (hWnd=0x60044) returned 0 [0049.203] IsWindowVisible (hWnd=0x2021a) returned 0 [0049.203] IsWindowVisible (hWnd=0x8004a) returned 0 [0049.203] GetActiveWindow () returned 0x7002e [0049.203] GetFocus () returned 0x7002e [0049.203] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0049.204] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0049.205] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0049.205] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0049.206] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0049.206] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0049.206] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0049.217] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0xd020c) returned 0x1 [0049.218] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0049.218] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0049.531] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0049.540] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0049.540] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0049.540] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0xd020c) returned 0x1 [0049.542] SetFocus (hWnd=0x7002e) returned 0xd020c [0049.544] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0049.545] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0049.545] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0049.545] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0049.545] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0xd020c, lParam=0x0) returned 0x0 [0049.549] IsWindow (hWnd=0x7002e) returned 1 [0049.549] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0049.549] IsWindow (hWnd=0x7002e) returned 1 [0049.549] SetFocus (hWnd=0x7002e) returned 0x7002e [0049.549] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0049.549] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0049.549] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0049.550] GetProcessWindowStation () returned 0x13c [0049.550] GetActiveWindow () returned 0x7002e [0049.550] GetCurrentActCtx (in: lphActCtx=0x8fe8f0 | out: lphActCtx=0x8fe8f0*=0x9f8cbc) returned 1 [0049.550] GetCurrentThreadId () returned 0x540 [0049.550] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c420a, lParam=0x0) returned 1 [0049.550] IsWindowVisible (hWnd=0x7002e) returned 0 [0049.550] IsWindowVisible (hWnd=0x4020e) returned 0 [0049.550] IsWindowVisible (hWnd=0x60044) returned 0 [0049.551] IsWindowVisible (hWnd=0x2021a) returned 0 [0049.551] IsWindowVisible (hWnd=0x8004a) returned 0 [0049.551] GetActiveWindow () returned 0x7002e [0049.551] GetFocus () returned 0x7002e [0049.551] MessageBoxW (hWnd=0x7002e, lpText="npEErzw2UHON1xmFZmKc1Q==", lpCaption="", uType=0x0) returned 1 [0049.552] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0049.552] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0049.565] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0049.566] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0049.566] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0049.567] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0049.579] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0xe020c) returned 0x1 [0049.580] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0049.580] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0049.696] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0049.703] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0049.703] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0049.703] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0xe020c) returned 0x1 [0049.705] SetFocus (hWnd=0x7002e) returned 0xe020c [0049.706] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0049.708] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0049.708] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0049.708] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0049.708] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0xe020c, lParam=0x0) returned 0x0 [0049.713] IsWindow (hWnd=0x7002e) returned 1 [0049.713] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0049.713] IsWindow (hWnd=0x7002e) returned 1 [0049.713] SetFocus (hWnd=0x7002e) returned 0x7002e [0049.713] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0049.713] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0049.713] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0049.714] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe4ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml", lpFilePart=0x0) returned 0x72 [0049.714] GetLastError () returned 0x0 [0049.714] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml", dwFileAttributes=0x80) returned 1 [0049.716] GetLastError () returned 0x0 [0049.716] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe3bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml", lpFilePart=0x0) returned 0x72 [0049.717] GetLastError () returned 0x0 [0049.717] SetErrorMode (uMode=0x1) returned 0x0 [0049.717] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\masterdescriptor.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0049.717] GetLastError () returned 0x0 [0049.717] GetFileType (hFile=0x440) returned 0x1 [0049.717] SetErrorMode (uMode=0x0) returned 0x1 [0049.717] GetFileType (hFile=0x440) returned 0x1 [0049.717] GetFileSize (in: hFile=0x440, lpFileSizeHigh=0x8fe970 | out: lpFileSizeHigh=0x8fe970*=0x0) returned 0x5211 [0049.718] GetLastError () returned 0x0 [0049.718] ReadFile (in: hFile=0x440, lpBuffer=0x2b08130, nNumberOfBytesToRead=0x5211, lpNumberOfBytesRead=0x8fe918, lpOverlapped=0x0 | out: lpBuffer=0x2b08130*, lpNumberOfBytesRead=0x8fe918*=0x5211, lpOverlapped=0x0) returned 1 [0049.720] GetLastError () returned 0x0 [0049.720] CloseHandle (hObject=0x440) returned 1 [0049.720] GetLastError () returned 0x0 [0049.720] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0049.720] GetLastError () returned 0x0 [0049.721] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8c0 | out: phKey=0x8fe8c0*=0x9f60e0) returned 1 [0049.721] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0049.721] GetLastError () returned 0x0 [0049.721] CryptSetKeyParam (hKey=0x9f60e0, dwParam=0x4, pbData=0x2b0d3b8*=0x1, dwFlags=0x0) returned 1 [0049.721] GetLastError () returned 0x0 [0049.721] CryptSetKeyParam (hKey=0x9f60e0, dwParam=0x1, pbData=0x2b0d384, dwFlags=0x0) returned 1 [0049.721] GetLastError () returned 0x0 [0049.723] CryptEncrypt (in: hKey=0x9f60e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b0d3c8*, pdwDataLen=0x8fe978*=0x5220, dwBufLen=0x5220 | out: pbData=0x2b0d3c8*, pdwDataLen=0x8fe978*=0x5220) returned 1 [0049.723] GetLastError () returned 0x0 [0049.723] CryptEncrypt (in: hKey=0x9f60e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b12608*, pdwDataLen=0x8fe980*=0x0, dwBufLen=0x10 | out: pbData=0x2b12608*, pdwDataLen=0x8fe980*=0x10) returned 1 [0049.723] GetLastError () returned 0x0 [0049.723] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml", lpFilePart=0x0) returned 0x72 [0049.723] GetLastError () returned 0x0 [0049.723] SetErrorMode (uMode=0x1) returned 0x0 [0049.723] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\masterdescriptor.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0049.724] GetLastError () returned 0xb7 [0049.724] GetFileType (hFile=0x440) returned 0x1 [0049.724] SetErrorMode (uMode=0x0) returned 0x1 [0049.724] GetFileType (hFile=0x440) returned 0x1 [0049.725] WriteFile (in: hFile=0x440, lpBuffer=0x2b0d3c8*, nNumberOfBytesToWrite=0x5220, lpNumberOfBytesWritten=0x8fe924, lpOverlapped=0x0 | out: lpBuffer=0x2b0d3c8*, lpNumberOfBytesWritten=0x8fe924*=0x5220, lpOverlapped=0x0) returned 1 [0049.730] GetLastError () returned 0xb7 [0049.730] CloseHandle (hObject=0x440) returned 1 [0049.732] GetLastError () returned 0xb7 [0049.732] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml.npEErzw2UHON1xmFZmKc1Q==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml.npEErzw2UHON1xmFZmKc1Q==.bwall", lpFilePart=0x0) returned 0x91 [0049.732] GetLastError () returned 0xb7 [0049.732] SetErrorMode (uMode=0x1) returned 0x0 [0049.732] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml.npEErzw2UHON1xmFZmKc1Q==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\masterdescriptor.x-none.xml.npeerzw2uhon1xmfzmkc1q==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0049.733] GetLastError () returned 0x0 [0049.733] GetFileType (hFile=0x440) returned 0x1 [0049.733] SetErrorMode (uMode=0x0) returned 0x1 [0049.733] GetFileType (hFile=0x440) returned 0x1 [0049.733] WriteFile (in: hFile=0x440, lpBuffer=0x2b0d3c8*, nNumberOfBytesToWrite=0x5220, lpNumberOfBytesWritten=0x8fe924, lpOverlapped=0x0 | out: lpBuffer=0x2b0d3c8*, lpNumberOfBytesWritten=0x8fe924*=0x5220, lpOverlapped=0x0) returned 1 [0049.735] GetLastError () returned 0x0 [0049.735] CloseHandle (hObject=0x440) returned 1 [0049.736] GetLastError () returned 0x0 [0049.736] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml", lpFilePart=0x0) returned 0x72 [0049.736] GetLastError () returned 0x0 [0049.736] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\masterdescriptor.x-none.xml")) returned 1 [0049.737] GetLastError () returned 0x0 [0049.743] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16", lpFilePart=0x0) returned 0x56 [0049.743] GetLastError () returned 0x0 [0049.743] SetErrorMode (uMode=0x1) returned 0x0 [0049.743] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xcd0256ab, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6560 [0049.743] GetLastError () returned 0x0 [0049.743] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xcd0256ab, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.743] GetLastError () returned 0x0 [0049.743] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd0256ab, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xcd0256ab, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xcd0256ab, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x5220, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.x-none.xml.npEErzw2UHON1xmFZmKc1Q==.bwall", cAlternateFileName="MASTER~1.BWA")) returned 1 [0049.743] GetLastError () returned 0x0 [0049.744] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a302bd, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a302bd, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s640.hash", cAlternateFileName="S640~1.HAS")) returned 1 [0049.744] GetLastError () returned 0x0 [0049.744] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a302bd, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a302bd, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0049.744] GetLastError () returned 0x0 [0049.744] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a302bd, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a302bd, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0049.744] GetLastError () returned 0x12 [0049.744] FindClose (in: hFindFile=0x9f6560 | out: hFindFile=0x9f6560) returned 1 [0049.744] SetErrorMode (uMode=0x0) returned 0x1 [0049.746] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe3dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x69 [0049.746] GetLastError () returned 0x12 [0049.746] SetErrorMode (uMode=0x1) returned 0x0 [0049.746] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x440 [0049.746] GetLastError () returned 0x0 [0049.746] GetFileType (hFile=0x440) returned 0x1 [0049.746] SetErrorMode (uMode=0x0) returned 0x1 [0049.746] GetFileType (hFile=0x440) returned 0x1 [0049.747] WriteFile (in: hFile=0x440, lpBuffer=0x2b24d70*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe934, lpOverlapped=0x0 | out: lpBuffer=0x2b24d70*, lpNumberOfBytesWritten=0x8fe934*=0xbcb, lpOverlapped=0x0) returned 1 [0049.749] GetLastError () returned 0x0 [0049.749] CloseHandle (hObject=0x440) returned 1 [0049.749] GetLastError () returned 0x0 [0049.750] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x5f [0049.750] GetLastError () returned 0x0 [0049.750] SetErrorMode (uMode=0x1) returned 0x0 [0049.750] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x440 [0049.751] GetLastError () returned 0x0 [0049.751] GetFileType (hFile=0x440) returned 0x1 [0049.751] SetErrorMode (uMode=0x0) returned 0x1 [0049.751] GetFileType (hFile=0x440) returned 0x1 [0049.751] WriteFile (in: hFile=0x440, lpBuffer=0x2b2bad8*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe968, lpOverlapped=0x0 | out: lpBuffer=0x2b2bad8*, lpNumberOfBytesWritten=0x8fe968*=0xbcb, lpOverlapped=0x0) returned 1 [0049.752] GetLastError () returned 0x0 [0049.752] CloseHandle (hObject=0x440) returned 1 [0049.753] GetLastError () returned 0x0 [0049.753] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", lpFilePart=0x0) returned 0x4c [0049.753] GetLastError () returned 0x0 [0049.753] SetErrorMode (uMode=0x1) returned 0x0 [0049.753] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6560 [0049.753] GetLastError () returned 0x0 [0049.753] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.753] GetLastError () returned 0x0 [0049.754] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1 [0049.754] GetLastError () returned 0x0 [0049.754] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ec13b1, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0049.754] GetLastError () returned 0x0 [0049.754] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ec13b1, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0049.754] GetLastError () returned 0x12 [0049.754] FindClose (in: hFindFile=0x9f6560 | out: hFindFile=0x9f6560) returned 1 [0049.754] SetErrorMode (uMode=0x0) returned 0x1 [0049.754] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", lpFilePart=0x0) returned 0x4c [0049.754] GetLastError () returned 0x12 [0049.754] SetErrorMode (uMode=0x1) returned 0x0 [0049.754] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6060 [0049.755] GetLastError () returned 0x12 [0049.755] FindNextFileW (in: hFindFile=0x9f6060, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.755] GetLastError () returned 0x12 [0049.755] FindNextFileW (in: hFindFile=0x9f6060, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1 [0049.755] GetLastError () returned 0x12 [0049.755] FindNextFileW (in: hFindFile=0x9f6060, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ec13b1, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0049.755] GetLastError () returned 0x12 [0049.755] FindNextFileW (in: hFindFile=0x9f6060, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ec13b1, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0049.755] GetLastError () returned 0x12 [0049.756] FindClose (in: hFindFile=0x9f6060 | out: hFindFile=0x9f6060) returned 1 [0049.756] SetErrorMode (uMode=0x0) returned 0x1 [0049.756] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16", lpFilePart=0x0) returned 0x55 [0049.756] GetLastError () returned 0x12 [0049.758] SetErrorMode (uMode=0x1) returned 0x0 [0049.758] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6060 [0049.759] GetLastError () returned 0x12 [0049.760] FindNextFileW (in: hFindFile=0x9f6060, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.760] GetLastError () returned 0x12 [0049.760] FindNextFileW (in: hFindFile=0x9f6060, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x39768000, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x564f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0049.760] GetLastError () returned 0x12 [0049.760] FindNextFileW (in: hFindFile=0x9f6060, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s641033.hash", cAlternateFileName="S64103~1.HAS")) returned 1 [0049.760] GetLastError () returned 0x12 [0049.760] FindNextFileW (in: hFindFile=0x9f6060, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x3e87ff00, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0049.760] GetLastError () returned 0x12 [0049.760] FindNextFileW (in: hFindFile=0x9f6060, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x3e87ff00, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0049.760] GetLastError () returned 0x12 [0049.761] FindClose (in: hFindFile=0x9f6060 | out: hFindFile=0x9f6060) returned 1 [0049.761] SetErrorMode (uMode=0x0) returned 0x1 [0049.762] GetProcessWindowStation () returned 0x13c [0049.762] GetActiveWindow () returned 0x7002e [0049.762] GetCurrentActCtx (in: lphActCtx=0x8fe8f0 | out: lphActCtx=0x8fe8f0*=0x9f8cbc) returned 1 [0049.762] GetCurrentThreadId () returned 0x540 [0049.763] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c44aa, lParam=0x0) returned 1 [0049.764] IsWindowVisible (hWnd=0x7002e) returned 0 [0049.764] IsWindowVisible (hWnd=0x4020e) returned 0 [0049.764] IsWindowVisible (hWnd=0x60044) returned 0 [0049.764] IsWindowVisible (hWnd=0x2021a) returned 0 [0049.764] IsWindowVisible (hWnd=0x8004a) returned 0 [0049.764] GetActiveWindow () returned 0x7002e [0049.764] GetFocus () returned 0x7002e [0049.764] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0049.765] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0049.766] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0049.766] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0049.767] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0049.767] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0049.767] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0049.774] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0xf020c) returned 0x1 [0049.775] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0049.775] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0050.041] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0050.049] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0050.049] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0050.049] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0xf020c) returned 0x1 [0050.050] SetFocus (hWnd=0x7002e) returned 0xf020c [0050.052] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0050.059] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0050.059] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0050.060] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0050.060] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0xf020c, lParam=0x0) returned 0x0 [0050.064] IsWindow (hWnd=0x7002e) returned 1 [0050.064] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0050.064] IsWindow (hWnd=0x7002e) returned 1 [0050.064] SetFocus (hWnd=0x7002e) returned 0x7002e [0050.064] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0050.064] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0050.064] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0050.065] GetProcessWindowStation () returned 0x13c [0050.065] GetActiveWindow () returned 0x7002e [0050.065] GetCurrentActCtx (in: lphActCtx=0x8fe8f0 | out: lphActCtx=0x8fe8f0*=0x9f8cbc) returned 1 [0050.065] GetCurrentThreadId () returned 0x540 [0050.065] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c423a, lParam=0x0) returned 1 [0050.065] IsWindowVisible (hWnd=0x7002e) returned 0 [0050.065] IsWindowVisible (hWnd=0x4020e) returned 0 [0050.065] IsWindowVisible (hWnd=0x60044) returned 0 [0050.066] IsWindowVisible (hWnd=0x2021a) returned 0 [0050.066] IsWindowVisible (hWnd=0x8004a) returned 0 [0050.066] GetActiveWindow () returned 0x7002e [0050.066] GetFocus () returned 0x7002e [0050.066] MessageBoxW (hWnd=0x7002e, lpText="ZyHUUDhMWd6w1BNyPOjW5Q==", lpCaption="", uType=0x0) returned 1 [0050.067] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0050.067] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0050.068] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0050.068] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0050.068] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0050.069] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0050.075] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x10020c) returned 0x1 [0050.076] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0050.076] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0050.375] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0050.392] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0050.392] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0050.392] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x10020c) returned 0x1 [0050.394] SetFocus (hWnd=0x7002e) returned 0x10020c [0050.396] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0050.397] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0050.398] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0050.398] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0050.398] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x10020c, lParam=0x0) returned 0x0 [0050.402] IsWindow (hWnd=0x7002e) returned 1 [0050.403] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0050.403] IsWindow (hWnd=0x7002e) returned 1 [0050.403] SetFocus (hWnd=0x7002e) returned 0x7002e [0050.403] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0050.403] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0050.403] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0050.403] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe4ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml", lpFilePart=0x0) returned 0x70 [0050.403] GetLastError () returned 0x0 [0050.403] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml", dwFileAttributes=0x80) returned 1 [0050.405] GetLastError () returned 0x0 [0050.405] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml", lpFilePart=0x0) returned 0x70 [0050.405] GetLastError () returned 0x0 [0050.405] SetErrorMode (uMode=0x1) returned 0x0 [0050.405] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\masterdescriptor.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0050.406] GetLastError () returned 0x0 [0050.406] GetFileType (hFile=0x440) returned 0x1 [0050.406] SetErrorMode (uMode=0x0) returned 0x1 [0050.406] GetFileType (hFile=0x440) returned 0x1 [0050.406] GetFileSize (in: hFile=0x440, lpFileSizeHigh=0x8fe970 | out: lpFileSizeHigh=0x8fe970*=0x0) returned 0x564f [0050.406] GetLastError () returned 0x0 [0050.407] ReadFile (in: hFile=0x440, lpBuffer=0x2b307bc, nNumberOfBytesToRead=0x564f, lpNumberOfBytesRead=0x8fe918, lpOverlapped=0x0 | out: lpBuffer=0x2b307bc*, lpNumberOfBytesRead=0x8fe918*=0x564f, lpOverlapped=0x0) returned 1 [0050.408] GetLastError () returned 0x0 [0050.408] CloseHandle (hObject=0x440) returned 1 [0050.408] GetLastError () returned 0x0 [0050.409] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0050.409] GetLastError () returned 0x0 [0050.409] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8c0 | out: phKey=0x8fe8c0*=0x9f62e0) returned 1 [0050.409] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0050.409] GetLastError () returned 0x0 [0050.409] CryptSetKeyParam (hKey=0x9f62e0, dwParam=0x4, pbData=0x2b35e80*=0x1, dwFlags=0x0) returned 1 [0050.409] GetLastError () returned 0x0 [0050.409] CryptSetKeyParam (hKey=0x9f62e0, dwParam=0x1, pbData=0x2b35e4c, dwFlags=0x0) returned 1 [0050.409] GetLastError () returned 0x0 [0050.409] CryptEncrypt (in: hKey=0x9f62e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b35e90*, pdwDataLen=0x8fe978*=0x5650, dwBufLen=0x5650 | out: pbData=0x2b35e90*, pdwDataLen=0x8fe978*=0x5650) returned 1 [0050.410] GetLastError () returned 0x0 [0050.410] CryptEncrypt (in: hKey=0x9f62e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b3b500*, pdwDataLen=0x8fe980*=0x0, dwBufLen=0x10 | out: pbData=0x2b3b500*, pdwDataLen=0x8fe980*=0x10) returned 1 [0050.410] GetLastError () returned 0x0 [0050.410] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml", lpFilePart=0x0) returned 0x70 [0050.410] GetLastError () returned 0x0 [0050.410] SetErrorMode (uMode=0x1) returned 0x0 [0050.410] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\masterdescriptor.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0050.411] GetLastError () returned 0xb7 [0050.411] GetFileType (hFile=0x440) returned 0x1 [0050.411] SetErrorMode (uMode=0x0) returned 0x1 [0050.411] GetFileType (hFile=0x440) returned 0x1 [0050.411] WriteFile (in: hFile=0x440, lpBuffer=0x2b35e90*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x8fe924, lpOverlapped=0x0 | out: lpBuffer=0x2b35e90*, lpNumberOfBytesWritten=0x8fe924*=0x5650, lpOverlapped=0x0) returned 1 [0050.418] GetLastError () returned 0xb7 [0050.418] CloseHandle (hObject=0x440) returned 1 [0050.419] GetLastError () returned 0xb7 [0050.420] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml.ZyHUUDhMWd6w1BNyPOjW5Q==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml.ZyHUUDhMWd6w1BNyPOjW5Q==.bwall", lpFilePart=0x0) returned 0x8f [0050.420] GetLastError () returned 0xb7 [0050.420] SetErrorMode (uMode=0x1) returned 0x0 [0050.420] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml.ZyHUUDhMWd6w1BNyPOjW5Q==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\masterdescriptor.en-us.xml.zyhuudhmwd6w1bnypojw5q==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0050.420] GetLastError () returned 0x0 [0050.420] GetFileType (hFile=0x440) returned 0x1 [0050.420] SetErrorMode (uMode=0x0) returned 0x1 [0050.420] GetFileType (hFile=0x440) returned 0x1 [0050.420] WriteFile (in: hFile=0x440, lpBuffer=0x2b35e90*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x8fe924, lpOverlapped=0x0 | out: lpBuffer=0x2b35e90*, lpNumberOfBytesWritten=0x8fe924*=0x5650, lpOverlapped=0x0) returned 1 [0050.422] GetLastError () returned 0x0 [0050.422] CloseHandle (hObject=0x440) returned 1 [0050.422] GetLastError () returned 0x0 [0050.422] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml", lpFilePart=0x0) returned 0x70 [0050.422] GetLastError () returned 0x0 [0050.422] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\masterdescriptor.en-us.xml")) returned 1 [0050.423] GetLastError () returned 0x0 [0050.430] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16", lpFilePart=0x0) returned 0x55 [0050.430] GetLastError () returned 0x0 [0050.430] SetErrorMode (uMode=0x1) returned 0x0 [0050.430] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xcd6b3dab, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6160 [0050.431] GetLastError () returned 0x0 [0050.431] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xcd6b3dab, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.431] GetLastError () returned 0x0 [0050.431] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd6b3dab, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xcd6b3dab, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xcd6b3dab, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x5650, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.en-us.xml.ZyHUUDhMWd6w1BNyPOjW5Q==.bwall", cAlternateFileName="MASTER~1.BWA")) returned 1 [0050.431] GetLastError () returned 0x0 [0050.431] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s641033.hash", cAlternateFileName="S64103~1.HAS")) returned 1 [0050.431] GetLastError () returned 0x0 [0050.431] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x3e87ff00, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0050.431] GetLastError () returned 0x0 [0050.432] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x3e87ff00, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0050.432] GetLastError () returned 0x12 [0050.432] FindClose (in: hFindFile=0x9f6160 | out: hFindFile=0x9f6160) returned 1 [0050.432] SetErrorMode (uMode=0x0) returned 0x1 [0050.433] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe3dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x68 [0050.433] GetLastError () returned 0x12 [0050.433] SetErrorMode (uMode=0x1) returned 0x0 [0050.433] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x440 [0050.433] GetLastError () returned 0x0 [0050.433] GetFileType (hFile=0x440) returned 0x1 [0050.433] SetErrorMode (uMode=0x0) returned 0x1 [0050.433] GetFileType (hFile=0x440) returned 0x1 [0050.434] WriteFile (in: hFile=0x440, lpBuffer=0x2b4dc40*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe934, lpOverlapped=0x0 | out: lpBuffer=0x2b4dc40*, lpNumberOfBytesWritten=0x8fe934*=0xbcb, lpOverlapped=0x0) returned 1 [0050.435] GetLastError () returned 0x0 [0050.435] CloseHandle (hObject=0x440) returned 1 [0050.435] GetLastError () returned 0x0 [0050.435] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16", lpFilePart=0x0) returned 0x56 [0050.435] GetLastError () returned 0x0 [0050.435] SetErrorMode (uMode=0x1) returned 0x0 [0050.435] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ec13b1, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f66e0 [0050.436] GetLastError () returned 0x0 [0050.436] FindNextFileW (in: hFindFile=0x9f66e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ec13b1, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.436] GetLastError () returned 0x0 [0050.436] FindNextFileW (in: hFindFile=0x9f66e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x37142600, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x5211, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0050.436] GetLastError () returned 0x0 [0050.437] FindNextFileW (in: hFindFile=0x9f66e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s640.hash", cAlternateFileName="S640~1.HAS")) returned 1 [0050.437] GetLastError () returned 0x0 [0050.437] FindNextFileW (in: hFindFile=0x9f66e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0050.437] GetLastError () returned 0x0 [0050.437] FindNextFileW (in: hFindFile=0x9f66e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0050.437] GetLastError () returned 0x12 [0050.437] FindClose (in: hFindFile=0x9f66e0 | out: hFindFile=0x9f66e0) returned 1 [0050.438] SetErrorMode (uMode=0x0) returned 0x1 [0050.438] GetProcessWindowStation () returned 0x13c [0050.438] GetActiveWindow () returned 0x7002e [0050.438] GetCurrentActCtx (in: lphActCtx=0x8fe8f0 | out: lphActCtx=0x8fe8f0*=0x9f8cbc) returned 1 [0050.438] GetCurrentThreadId () returned 0x540 [0050.439] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c438a, lParam=0x0) returned 1 [0050.439] IsWindowVisible (hWnd=0x7002e) returned 0 [0050.439] IsWindowVisible (hWnd=0x4020e) returned 0 [0050.439] IsWindowVisible (hWnd=0x60044) returned 0 [0050.439] IsWindowVisible (hWnd=0x2021a) returned 0 [0050.439] IsWindowVisible (hWnd=0x8004a) returned 0 [0050.439] GetActiveWindow () returned 0x7002e [0050.440] GetFocus () returned 0x7002e [0050.440] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0050.441] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0050.441] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0050.442] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0050.442] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0050.442] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0050.443] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0050.451] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x11020c) returned 0x1 [0050.452] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0050.452] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0050.808] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0050.816] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0050.816] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0050.816] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x11020c) returned 0x1 [0050.818] SetFocus (hWnd=0x7002e) returned 0x11020c [0050.820] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0050.821] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0050.821] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0050.821] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0050.821] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x11020c, lParam=0x0) returned 0x0 [0050.826] IsWindow (hWnd=0x7002e) returned 1 [0050.826] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0050.826] IsWindow (hWnd=0x7002e) returned 1 [0050.826] SetFocus (hWnd=0x7002e) returned 0x7002e [0050.826] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0050.826] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0050.826] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0050.826] GetProcessWindowStation () returned 0x13c [0050.826] GetActiveWindow () returned 0x7002e [0050.826] GetCurrentActCtx (in: lphActCtx=0x8fe8f0 | out: lphActCtx=0x8fe8f0*=0x9f8cbc) returned 1 [0050.826] GetCurrentThreadId () returned 0x540 [0050.827] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c44da, lParam=0x0) returned 1 [0050.827] IsWindowVisible (hWnd=0x7002e) returned 0 [0050.827] IsWindowVisible (hWnd=0x4020e) returned 0 [0050.827] IsWindowVisible (hWnd=0x60044) returned 0 [0050.827] IsWindowVisible (hWnd=0x2021a) returned 0 [0050.827] IsWindowVisible (hWnd=0x8004a) returned 0 [0050.827] GetActiveWindow () returned 0x7002e [0050.827] GetFocus () returned 0x7002e [0050.827] MessageBoxW (hWnd=0x7002e, lpText="Dn/NZpAIrWZqRE2J2SSX8g==", lpCaption="", uType=0x0) returned 1 [0050.829] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0050.829] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0050.830] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0050.830] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0050.830] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0050.830] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0050.842] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x12020c) returned 0x1 [0050.843] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0050.843] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0051.125] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0051.135] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0051.136] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0051.136] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x12020c) returned 0x1 [0051.137] SetFocus (hWnd=0x7002e) returned 0x12020c [0051.139] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0051.140] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0051.140] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0051.140] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0051.140] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x12020c, lParam=0x0) returned 0x0 [0051.145] IsWindow (hWnd=0x7002e) returned 1 [0051.145] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0051.145] IsWindow (hWnd=0x7002e) returned 1 [0051.145] SetFocus (hWnd=0x7002e) returned 0x7002e [0051.145] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0051.145] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0051.145] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0051.146] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe4ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml", lpFilePart=0x0) returned 0x72 [0051.146] GetLastError () returned 0x0 [0051.146] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml", dwFileAttributes=0x80) returned 1 [0051.153] GetLastError () returned 0x0 [0051.153] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe3bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml", lpFilePart=0x0) returned 0x72 [0051.153] GetLastError () returned 0x0 [0051.153] SetErrorMode (uMode=0x1) returned 0x0 [0051.153] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\masterdescriptor.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0051.153] GetLastError () returned 0x0 [0051.153] GetFileType (hFile=0x440) returned 0x1 [0051.153] SetErrorMode (uMode=0x0) returned 0x1 [0051.153] GetFileType (hFile=0x440) returned 0x1 [0051.154] GetFileSize (in: hFile=0x440, lpFileSizeHigh=0x8fe970 | out: lpFileSizeHigh=0x8fe970*=0x0) returned 0x5211 [0051.154] GetLastError () returned 0x0 [0051.154] ReadFile (in: hFile=0x440, lpBuffer=0x2b516cc, nNumberOfBytesToRead=0x5211, lpNumberOfBytesRead=0x8fe918, lpOverlapped=0x0 | out: lpBuffer=0x2b516cc*, lpNumberOfBytesRead=0x8fe918*=0x5211, lpOverlapped=0x0) returned 1 [0051.156] GetLastError () returned 0x0 [0051.156] CloseHandle (hObject=0x440) returned 1 [0051.157] GetLastError () returned 0x0 [0051.157] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0051.157] GetLastError () returned 0x0 [0051.157] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8c0 | out: phKey=0x8fe8c0*=0x9f66e0) returned 1 [0051.157] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0051.157] GetLastError () returned 0x0 [0051.157] CryptSetKeyParam (hKey=0x9f66e0, dwParam=0x4, pbData=0x2b56954*=0x1, dwFlags=0x0) returned 1 [0051.157] GetLastError () returned 0x0 [0051.157] CryptSetKeyParam (hKey=0x9f66e0, dwParam=0x1, pbData=0x2b56920, dwFlags=0x0) returned 1 [0051.157] GetLastError () returned 0x0 [0051.157] CryptEncrypt (in: hKey=0x9f66e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b56964*, pdwDataLen=0x8fe978*=0x5220, dwBufLen=0x5220 | out: pbData=0x2b56964*, pdwDataLen=0x8fe978*=0x5220) returned 1 [0051.158] GetLastError () returned 0x0 [0051.158] CryptEncrypt (in: hKey=0x9f66e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b5bba4*, pdwDataLen=0x8fe980*=0x0, dwBufLen=0x10 | out: pbData=0x2b5bba4*, pdwDataLen=0x8fe980*=0x10) returned 1 [0051.158] GetLastError () returned 0x0 [0051.158] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml", lpFilePart=0x0) returned 0x72 [0051.158] GetLastError () returned 0x0 [0051.158] SetErrorMode (uMode=0x1) returned 0x0 [0051.158] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\masterdescriptor.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0051.159] GetLastError () returned 0xb7 [0051.159] GetFileType (hFile=0x440) returned 0x1 [0051.159] SetErrorMode (uMode=0x0) returned 0x1 [0051.159] GetFileType (hFile=0x440) returned 0x1 [0051.159] WriteFile (in: hFile=0x440, lpBuffer=0x2b56964*, nNumberOfBytesToWrite=0x5220, lpNumberOfBytesWritten=0x8fe924, lpOverlapped=0x0 | out: lpBuffer=0x2b56964*, lpNumberOfBytesWritten=0x8fe924*=0x5220, lpOverlapped=0x0) returned 1 [0051.160] GetLastError () returned 0xb7 [0051.160] CloseHandle (hObject=0x440) returned 1 [0051.162] GetLastError () returned 0xb7 [0051.162] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml.Dn#NZpAIrWZqRE2J2SSX8g==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml.Dn#NZpAIrWZqRE2J2SSX8g==.bwall", lpFilePart=0x0) returned 0x91 [0051.162] GetLastError () returned 0xb7 [0051.162] SetErrorMode (uMode=0x1) returned 0x0 [0051.162] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml.Dn#NZpAIrWZqRE2J2SSX8g==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\masterdescriptor.x-none.xml.dn#nzpairwzqre2j2ssx8g==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0051.163] GetLastError () returned 0x0 [0051.163] GetFileType (hFile=0x440) returned 0x1 [0051.163] SetErrorMode (uMode=0x0) returned 0x1 [0051.164] GetFileType (hFile=0x440) returned 0x1 [0051.164] WriteFile (in: hFile=0x440, lpBuffer=0x2b56964*, nNumberOfBytesToWrite=0x5220, lpNumberOfBytesWritten=0x8fe924, lpOverlapped=0x0 | out: lpBuffer=0x2b56964*, lpNumberOfBytesWritten=0x8fe924*=0x5220, lpOverlapped=0x0) returned 1 [0051.165] GetLastError () returned 0x0 [0051.165] CloseHandle (hObject=0x440) returned 1 [0051.166] GetLastError () returned 0x0 [0051.166] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml", lpFilePart=0x0) returned 0x72 [0051.166] GetLastError () returned 0x0 [0051.166] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\masterdescriptor.x-none.xml")) returned 1 [0051.167] GetLastError () returned 0x0 [0051.172] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16", lpFilePart=0x0) returned 0x56 [0051.172] GetLastError () returned 0x0 [0051.173] SetErrorMode (uMode=0x1) returned 0x0 [0051.173] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xcdddae99, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f65a0 [0051.173] GetLastError () returned 0x0 [0051.173] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xcdddae99, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.173] GetLastError () returned 0x0 [0051.173] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdddae99, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xcdddae99, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xcdddae99, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x5220, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.x-none.xml.Dn#NZpAIrWZqRE2J2SSX8g==.bwall", cAlternateFileName="MASTER~1.BWA")) returned 1 [0051.173] GetLastError () returned 0x0 [0051.174] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s640.hash", cAlternateFileName="S640~1.HAS")) returned 1 [0051.174] GetLastError () returned 0x0 [0051.174] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0051.174] GetLastError () returned 0x0 [0051.174] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0051.174] GetLastError () returned 0x12 [0051.174] FindClose (in: hFindFile=0x9f65a0 | out: hFindFile=0x9f65a0) returned 1 [0051.174] SetErrorMode (uMode=0x0) returned 0x1 [0051.175] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe3dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x69 [0051.175] GetLastError () returned 0x12 [0051.175] SetErrorMode (uMode=0x1) returned 0x0 [0051.175] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x440 [0051.175] GetLastError () returned 0x0 [0051.175] GetFileType (hFile=0x440) returned 0x1 [0051.176] SetErrorMode (uMode=0x0) returned 0x1 [0051.176] GetFileType (hFile=0x440) returned 0x1 [0051.176] WriteFile (in: hFile=0x440, lpBuffer=0x2b6e350*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe934, lpOverlapped=0x0 | out: lpBuffer=0x2b6e350*, lpNumberOfBytesWritten=0x8fe934*=0xbcb, lpOverlapped=0x0) returned 1 [0051.177] GetLastError () returned 0x0 [0051.177] CloseHandle (hObject=0x440) returned 1 [0051.177] GetLastError () returned 0x0 [0051.180] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x5f [0051.180] GetLastError () returned 0x0 [0051.180] SetErrorMode (uMode=0x1) returned 0x0 [0051.180] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x440 [0051.181] GetLastError () returned 0x0 [0051.181] GetFileType (hFile=0x440) returned 0x1 [0051.181] SetErrorMode (uMode=0x0) returned 0x1 [0051.181] GetFileType (hFile=0x440) returned 0x1 [0051.181] WriteFile (in: hFile=0x440, lpBuffer=0x2b750b8*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe968, lpOverlapped=0x0 | out: lpBuffer=0x2b750b8*, lpNumberOfBytesWritten=0x8fe968*=0xbcb, lpOverlapped=0x0) returned 1 [0051.182] GetLastError () returned 0x0 [0051.182] CloseHandle (hObject=0x440) returned 1 [0051.182] GetLastError () returned 0x0 [0051.182] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6", lpFilePart=0x0) returned 0x4c [0051.183] GetLastError () returned 0x0 [0051.183] SetErrorMode (uMode=0x1) returned 0x0 [0051.183] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6560 [0051.184] GetLastError () returned 0x0 [0051.184] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.184] GetLastError () returned 0x0 [0051.185] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f9a029, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82f9a029, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1 [0051.185] GetLastError () returned 0x0 [0051.185] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0051.185] GetLastError () returned 0x0 [0051.185] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0051.185] GetLastError () returned 0x12 [0051.185] FindClose (in: hFindFile=0x9f6560 | out: hFindFile=0x9f6560) returned 1 [0051.186] SetErrorMode (uMode=0x0) returned 0x1 [0051.186] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6", lpFilePart=0x0) returned 0x4c [0051.186] GetLastError () returned 0x12 [0051.186] SetErrorMode (uMode=0x1) returned 0x0 [0051.186] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6160 [0051.187] GetLastError () returned 0x12 [0051.187] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.187] GetLastError () returned 0x12 [0051.187] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f9a029, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82f9a029, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1 [0051.187] GetLastError () returned 0x12 [0051.188] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0051.188] GetLastError () returned 0x12 [0051.188] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0051.188] GetLastError () returned 0x12 [0051.188] FindClose (in: hFindFile=0x9f6160 | out: hFindFile=0x9f6160) returned 1 [0051.189] SetErrorMode (uMode=0x0) returned 0x1 [0051.189] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16", lpFilePart=0x0) returned 0x55 [0051.189] GetLastError () returned 0x12 [0051.189] SetErrorMode (uMode=0x1) returned 0x0 [0051.189] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f9a029, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82f9a029, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6660 [0051.191] GetLastError () returned 0x12 [0051.191] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f9a029, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82f9a029, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.191] GetLastError () returned 0x12 [0051.191] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd7b21800, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x564f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0051.191] GetLastError () returned 0x12 [0051.192] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfe714e00, ftLastWriteTime.dwHighDateTime=0x1d0d7e7, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s641033.hash", cAlternateFileName="S64103~1.HAS")) returned 1 [0051.192] GetLastError () returned 0x12 [0051.192] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdcc39700, ftLastWriteTime.dwHighDateTime=0x1d0d7e6, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0051.192] GetLastError () returned 0x12 [0051.192] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdcc39700, ftLastWriteTime.dwHighDateTime=0x1d0d7e6, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0051.192] GetLastError () returned 0x12 [0051.192] FindClose (in: hFindFile=0x9f6660 | out: hFindFile=0x9f6660) returned 1 [0051.193] SetErrorMode (uMode=0x0) returned 0x1 [0051.193] GetProcessWindowStation () returned 0x13c [0051.193] GetActiveWindow () returned 0x7002e [0051.195] GetCurrentActCtx (in: lphActCtx=0x8fe8f0 | out: lphActCtx=0x8fe8f0*=0x9f8cbc) returned 1 [0051.195] GetCurrentThreadId () returned 0x540 [0051.196] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c450a, lParam=0x0) returned 1 [0051.196] IsWindowVisible (hWnd=0x7002e) returned 0 [0051.196] IsWindowVisible (hWnd=0x4020e) returned 0 [0051.196] IsWindowVisible (hWnd=0x60044) returned 0 [0051.196] IsWindowVisible (hWnd=0x2021a) returned 0 [0051.196] IsWindowVisible (hWnd=0x8004a) returned 0 [0051.196] GetActiveWindow () returned 0x7002e [0051.196] GetFocus () returned 0x7002e [0051.196] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0051.198] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0051.198] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0051.199] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0051.199] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0051.199] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0051.200] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0051.207] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x13020c) returned 0x1 [0051.208] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0051.208] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0051.538] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0051.548] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0051.548] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0051.549] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x13020c) returned 0x1 [0051.550] SetFocus (hWnd=0x7002e) returned 0x13020c [0051.552] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0051.554] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0051.554] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0051.554] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0051.554] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x13020c, lParam=0x0) returned 0x0 [0051.560] IsWindow (hWnd=0x7002e) returned 1 [0051.560] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0051.560] IsWindow (hWnd=0x7002e) returned 1 [0051.560] SetFocus (hWnd=0x7002e) returned 0x7002e [0051.560] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0051.560] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0051.560] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0051.561] GetProcessWindowStation () returned 0x13c [0051.561] GetActiveWindow () returned 0x7002e [0051.561] GetCurrentActCtx (in: lphActCtx=0x8fe8f0 | out: lphActCtx=0x8fe8f0*=0x9f8cbc) returned 1 [0051.561] GetCurrentThreadId () returned 0x540 [0051.562] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c453a, lParam=0x0) returned 1 [0051.562] IsWindowVisible (hWnd=0x7002e) returned 0 [0051.562] IsWindowVisible (hWnd=0x4020e) returned 0 [0051.562] IsWindowVisible (hWnd=0x60044) returned 0 [0051.562] IsWindowVisible (hWnd=0x2021a) returned 0 [0051.562] IsWindowVisible (hWnd=0x8004a) returned 0 [0051.562] GetActiveWindow () returned 0x7002e [0051.562] GetFocus () returned 0x7002e [0051.562] MessageBoxW (hWnd=0x7002e, lpText="eX/mp42DWoFjJZ2WeFXd3Q==", lpCaption="", uType=0x0) returned 1 [0051.563] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0051.565] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0051.566] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0051.567] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0051.567] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0051.567] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0051.576] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x14020c) returned 0x1 [0051.577] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0051.577] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0051.899] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0051.907] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0051.908] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0051.908] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x14020c) returned 0x1 [0051.909] SetFocus (hWnd=0x7002e) returned 0x14020c [0051.911] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0051.912] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0051.912] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0051.913] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0051.913] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x14020c, lParam=0x0) returned 0x0 [0051.918] IsWindow (hWnd=0x7002e) returned 1 [0051.918] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0051.918] IsWindow (hWnd=0x7002e) returned 1 [0051.919] SetFocus (hWnd=0x7002e) returned 0x7002e [0051.919] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0051.919] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0051.919] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0051.919] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe4ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml", lpFilePart=0x0) returned 0x70 [0051.919] GetLastError () returned 0x0 [0051.919] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml", dwFileAttributes=0x80) returned 1 [0051.922] GetLastError () returned 0x0 [0051.922] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml", lpFilePart=0x0) returned 0x70 [0051.922] GetLastError () returned 0x0 [0051.922] SetErrorMode (uMode=0x1) returned 0x0 [0051.922] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\masterdescriptor.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0051.922] GetLastError () returned 0x0 [0051.922] GetFileType (hFile=0x440) returned 0x1 [0051.922] SetErrorMode (uMode=0x0) returned 0x1 [0051.922] GetFileType (hFile=0x440) returned 0x1 [0051.922] GetFileSize (in: hFile=0x440, lpFileSizeHigh=0x8fe970 | out: lpFileSizeHigh=0x8fe970*=0x0) returned 0x564f [0051.922] GetLastError () returned 0x0 [0051.923] ReadFile (in: hFile=0x440, lpBuffer=0x2b79d9c, nNumberOfBytesToRead=0x564f, lpNumberOfBytesRead=0x8fe918, lpOverlapped=0x0 | out: lpBuffer=0x2b79d9c*, lpNumberOfBytesRead=0x8fe918*=0x564f, lpOverlapped=0x0) returned 1 [0051.925] GetLastError () returned 0x0 [0051.925] CloseHandle (hObject=0x440) returned 1 [0051.925] GetLastError () returned 0x0 [0051.925] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0051.925] GetLastError () returned 0x0 [0051.926] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8c0 | out: phKey=0x8fe8c0*=0x9f6660) returned 1 [0051.926] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0051.926] GetLastError () returned 0x0 [0051.926] CryptSetKeyParam (hKey=0x9f6660, dwParam=0x4, pbData=0x2b7f460*=0x1, dwFlags=0x0) returned 1 [0051.926] GetLastError () returned 0x0 [0051.926] CryptSetKeyParam (hKey=0x9f6660, dwParam=0x1, pbData=0x2b7f42c, dwFlags=0x0) returned 1 [0051.926] GetLastError () returned 0x0 [0051.927] CryptEncrypt (in: hKey=0x9f6660, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b7f470*, pdwDataLen=0x8fe978*=0x5650, dwBufLen=0x5650 | out: pbData=0x2b7f470*, pdwDataLen=0x8fe978*=0x5650) returned 1 [0051.927] GetLastError () returned 0x0 [0051.927] CryptEncrypt (in: hKey=0x9f6660, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b84ae0*, pdwDataLen=0x8fe980*=0x0, dwBufLen=0x10 | out: pbData=0x2b84ae0*, pdwDataLen=0x8fe980*=0x10) returned 1 [0051.927] GetLastError () returned 0x0 [0051.927] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml", lpFilePart=0x0) returned 0x70 [0051.927] GetLastError () returned 0x0 [0051.927] SetErrorMode (uMode=0x1) returned 0x0 [0051.928] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\masterdescriptor.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0051.934] GetLastError () returned 0xb7 [0051.934] GetFileType (hFile=0x440) returned 0x1 [0051.934] SetErrorMode (uMode=0x0) returned 0x1 [0051.934] GetFileType (hFile=0x440) returned 0x1 [0051.934] WriteFile (in: hFile=0x440, lpBuffer=0x2b7f470*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x8fe924, lpOverlapped=0x0 | out: lpBuffer=0x2b7f470*, lpNumberOfBytesWritten=0x8fe924*=0x5650, lpOverlapped=0x0) returned 1 [0051.936] GetLastError () returned 0xb7 [0051.936] CloseHandle (hObject=0x440) returned 1 [0051.937] GetLastError () returned 0xb7 [0051.937] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml.eX#mp42DWoFjJZ2WeFXd3Q==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml.eX#mp42DWoFjJZ2WeFXd3Q==.bwall", lpFilePart=0x0) returned 0x8f [0051.938] GetLastError () returned 0xb7 [0051.938] SetErrorMode (uMode=0x1) returned 0x0 [0051.938] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml.eX#mp42DWoFjJZ2WeFXd3Q==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\masterdescriptor.en-us.xml.ex#mp42dwofjjz2wefxd3q==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0051.938] GetLastError () returned 0x0 [0051.938] GetFileType (hFile=0x440) returned 0x1 [0051.939] SetErrorMode (uMode=0x0) returned 0x1 [0051.939] GetFileType (hFile=0x440) returned 0x1 [0051.939] WriteFile (in: hFile=0x440, lpBuffer=0x2b7f470*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x8fe924, lpOverlapped=0x0 | out: lpBuffer=0x2b7f470*, lpNumberOfBytesWritten=0x8fe924*=0x5650, lpOverlapped=0x0) returned 1 [0051.940] GetLastError () returned 0x0 [0051.940] CloseHandle (hObject=0x440) returned 1 [0051.941] GetLastError () returned 0x0 [0051.941] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml", lpFilePart=0x0) returned 0x70 [0051.941] GetLastError () returned 0x0 [0051.941] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\masterdescriptor.en-us.xml")) returned 1 [0051.942] GetLastError () returned 0x0 [0051.949] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16", lpFilePart=0x0) returned 0x55 [0051.950] GetLastError () returned 0x0 [0051.950] SetErrorMode (uMode=0x1) returned 0x0 [0051.950] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f9a029, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xce5283eb, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6260 [0051.950] GetLastError () returned 0x0 [0051.950] FindNextFileW (in: hFindFile=0x9f6260, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f9a029, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xce5283eb, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.950] GetLastError () returned 0x0 [0051.951] FindNextFileW (in: hFindFile=0x9f6260, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce5283eb, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xce5283eb, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xce5283eb, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x5650, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.en-us.xml.eX#mp42DWoFjJZ2WeFXd3Q==.bwall", cAlternateFileName="MASTER~1.BWA")) returned 1 [0051.951] GetLastError () returned 0x0 [0051.951] FindNextFileW (in: hFindFile=0x9f6260, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfe714e00, ftLastWriteTime.dwHighDateTime=0x1d0d7e7, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s641033.hash", cAlternateFileName="S64103~1.HAS")) returned 1 [0051.951] GetLastError () returned 0x0 [0051.951] FindNextFileW (in: hFindFile=0x9f6260, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdcc39700, ftLastWriteTime.dwHighDateTime=0x1d0d7e6, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0051.951] GetLastError () returned 0x0 [0051.951] FindNextFileW (in: hFindFile=0x9f6260, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdcc39700, ftLastWriteTime.dwHighDateTime=0x1d0d7e6, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0051.951] GetLastError () returned 0x12 [0051.951] FindClose (in: hFindFile=0x9f6260 | out: hFindFile=0x9f6260) returned 1 [0051.952] SetErrorMode (uMode=0x0) returned 0x1 [0051.953] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe3dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x68 [0051.953] GetLastError () returned 0x12 [0051.953] SetErrorMode (uMode=0x1) returned 0x0 [0051.953] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x440 [0051.953] GetLastError () returned 0x0 [0051.953] GetFileType (hFile=0x440) returned 0x1 [0051.953] SetErrorMode (uMode=0x0) returned 0x1 [0051.953] GetFileType (hFile=0x440) returned 0x1 [0051.954] WriteFile (in: hFile=0x440, lpBuffer=0x2b97264*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe934, lpOverlapped=0x0 | out: lpBuffer=0x2b97264*, lpNumberOfBytesWritten=0x8fe934*=0xbcb, lpOverlapped=0x0) returned 1 [0051.955] GetLastError () returned 0x0 [0051.955] CloseHandle (hObject=0x440) returned 1 [0051.955] GetLastError () returned 0x0 [0051.955] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16", lpFilePart=0x0) returned 0x56 [0051.955] GetLastError () returned 0x0 [0051.955] SetErrorMode (uMode=0x1) returned 0x0 [0051.955] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6560 [0051.965] GetLastError () returned 0x0 [0051.965] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.965] GetLastError () returned 0x0 [0051.965] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd54fbe00, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x5211, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0051.965] GetLastError () returned 0x0 [0051.965] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfe714e00, ftLastWriteTime.dwHighDateTime=0x1d0d7e7, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s640.hash", cAlternateFileName="S640~1.HAS")) returned 1 [0051.965] GetLastError () returned 0x0 [0051.966] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfe714e00, ftLastWriteTime.dwHighDateTime=0x1d0d7e7, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0051.966] GetLastError () returned 0x0 [0051.966] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfe714e00, ftLastWriteTime.dwHighDateTime=0x1d0d7e7, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0051.966] GetLastError () returned 0x12 [0051.966] FindClose (in: hFindFile=0x9f6560 | out: hFindFile=0x9f6560) returned 1 [0051.967] SetErrorMode (uMode=0x0) returned 0x1 [0051.967] GetProcessWindowStation () returned 0x13c [0051.967] GetActiveWindow () returned 0x7002e [0051.967] GetCurrentActCtx (in: lphActCtx=0x8fe8f0 | out: lphActCtx=0x8fe8f0*=0x9f8cbc) returned 1 [0051.967] GetCurrentThreadId () returned 0x540 [0051.967] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c456a, lParam=0x0) returned 1 [0051.968] IsWindowVisible (hWnd=0x7002e) returned 0 [0051.968] IsWindowVisible (hWnd=0x4020e) returned 0 [0051.968] IsWindowVisible (hWnd=0x60044) returned 0 [0051.968] IsWindowVisible (hWnd=0x2021a) returned 0 [0051.968] IsWindowVisible (hWnd=0x8004a) returned 0 [0051.968] GetActiveWindow () returned 0x7002e [0051.968] GetFocus () returned 0x7002e [0051.968] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0051.969] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0051.970] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0051.970] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0051.971] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0051.971] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0051.971] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0051.980] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x15020c) returned 0x1 [0051.981] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0051.981] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0052.172] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0052.182] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0052.183] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0052.183] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x15020c) returned 0x1 [0052.184] SetFocus (hWnd=0x7002e) returned 0x15020c [0052.186] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0052.187] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0052.187] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0052.187] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0052.187] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x15020c, lParam=0x0) returned 0x0 [0052.192] IsWindow (hWnd=0x7002e) returned 1 [0052.192] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0052.192] IsWindow (hWnd=0x7002e) returned 1 [0052.192] SetFocus (hWnd=0x7002e) returned 0x7002e [0052.192] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0052.192] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0052.192] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0052.192] GetProcessWindowStation () returned 0x13c [0052.192] GetActiveWindow () returned 0x7002e [0052.192] GetCurrentActCtx (in: lphActCtx=0x8fe8f0 | out: lphActCtx=0x8fe8f0*=0x9f8cbc) returned 1 [0052.193] GetCurrentThreadId () returned 0x540 [0052.193] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c432a, lParam=0x0) returned 1 [0052.193] IsWindowVisible (hWnd=0x7002e) returned 0 [0052.193] IsWindowVisible (hWnd=0x4020e) returned 0 [0052.193] IsWindowVisible (hWnd=0x60044) returned 0 [0052.193] IsWindowVisible (hWnd=0x2021a) returned 0 [0052.193] IsWindowVisible (hWnd=0x8004a) returned 0 [0052.194] GetActiveWindow () returned 0x7002e [0052.194] GetFocus () returned 0x7002e [0052.194] MessageBoxW (hWnd=0x7002e, lpText="ZY109leGlcJEDtp+OZgtcA==", lpCaption="", uType=0x0) returned 1 [0052.195] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0052.195] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0052.196] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0052.196] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0052.196] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0052.197] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0052.203] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x16020c) returned 0x1 [0052.203] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0052.204] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0052.504] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0052.513] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0052.513] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0052.513] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x16020c) returned 0x1 [0052.515] SetFocus (hWnd=0x7002e) returned 0x16020c [0052.516] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0052.518] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0052.518] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0052.518] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0052.518] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x16020c, lParam=0x0) returned 0x0 [0052.525] IsWindow (hWnd=0x7002e) returned 1 [0052.525] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0052.525] IsWindow (hWnd=0x7002e) returned 1 [0052.525] SetFocus (hWnd=0x7002e) returned 0x7002e [0052.525] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0052.525] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0052.525] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0052.525] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe4ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml", lpFilePart=0x0) returned 0x72 [0052.525] GetLastError () returned 0x0 [0052.526] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml", dwFileAttributes=0x80) returned 1 [0052.527] GetLastError () returned 0x0 [0052.527] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe3bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml", lpFilePart=0x0) returned 0x72 [0052.527] GetLastError () returned 0x0 [0052.527] SetErrorMode (uMode=0x1) returned 0x0 [0052.528] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\masterdescriptor.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0052.528] GetLastError () returned 0x0 [0052.528] GetFileType (hFile=0x440) returned 0x1 [0052.528] SetErrorMode (uMode=0x0) returned 0x1 [0052.528] GetFileType (hFile=0x440) returned 0x1 [0052.528] GetFileSize (in: hFile=0x440, lpFileSizeHigh=0x8fe970 | out: lpFileSizeHigh=0x8fe970*=0x0) returned 0x5211 [0052.528] GetLastError () returned 0x0 [0052.529] ReadFile (in: hFile=0x440, lpBuffer=0x2b9acf0, nNumberOfBytesToRead=0x5211, lpNumberOfBytesRead=0x8fe918, lpOverlapped=0x0 | out: lpBuffer=0x2b9acf0*, lpNumberOfBytesRead=0x8fe918*=0x5211, lpOverlapped=0x0) returned 1 [0052.530] GetLastError () returned 0x0 [0052.530] CloseHandle (hObject=0x440) returned 1 [0052.530] GetLastError () returned 0x0 [0052.530] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0052.530] GetLastError () returned 0x0 [0052.531] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8c0 | out: phKey=0x8fe8c0*=0x9f6560) returned 1 [0052.531] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0052.531] GetLastError () returned 0x0 [0052.531] CryptSetKeyParam (hKey=0x9f6560, dwParam=0x4, pbData=0x2b9ff78*=0x1, dwFlags=0x0) returned 1 [0052.531] GetLastError () returned 0x0 [0052.531] CryptSetKeyParam (hKey=0x9f6560, dwParam=0x1, pbData=0x2b9ff44, dwFlags=0x0) returned 1 [0052.531] GetLastError () returned 0x0 [0052.532] CryptEncrypt (in: hKey=0x9f6560, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b9ff88*, pdwDataLen=0x8fe978*=0x5220, dwBufLen=0x5220 | out: pbData=0x2b9ff88*, pdwDataLen=0x8fe978*=0x5220) returned 1 [0052.532] GetLastError () returned 0x0 [0052.532] CryptEncrypt (in: hKey=0x9f6560, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ba51c8*, pdwDataLen=0x8fe980*=0x0, dwBufLen=0x10 | out: pbData=0x2ba51c8*, pdwDataLen=0x8fe980*=0x10) returned 1 [0052.532] GetLastError () returned 0x0 [0052.532] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml", lpFilePart=0x0) returned 0x72 [0052.532] GetLastError () returned 0x0 [0052.532] SetErrorMode (uMode=0x1) returned 0x0 [0052.532] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\masterdescriptor.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0052.533] GetLastError () returned 0xb7 [0052.533] GetFileType (hFile=0x440) returned 0x1 [0052.533] SetErrorMode (uMode=0x0) returned 0x1 [0052.533] GetFileType (hFile=0x440) returned 0x1 [0052.533] WriteFile (in: hFile=0x440, lpBuffer=0x2b9ff88*, nNumberOfBytesToWrite=0x5220, lpNumberOfBytesWritten=0x8fe924, lpOverlapped=0x0 | out: lpBuffer=0x2b9ff88*, lpNumberOfBytesWritten=0x8fe924*=0x5220, lpOverlapped=0x0) returned 1 [0052.535] GetLastError () returned 0xb7 [0052.535] CloseHandle (hObject=0x440) returned 1 [0052.537] GetLastError () returned 0xb7 [0052.537] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml.ZY109leGlcJEDtp+OZgtcA==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml.ZY109leGlcJEDtp+OZgtcA==.bwall", lpFilePart=0x0) returned 0x91 [0052.537] GetLastError () returned 0xb7 [0052.537] SetErrorMode (uMode=0x1) returned 0x0 [0052.537] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml.ZY109leGlcJEDtp+OZgtcA==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\masterdescriptor.x-none.xml.zy109leglcjedtp+ozgtca==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0052.540] GetLastError () returned 0x0 [0052.540] GetFileType (hFile=0x440) returned 0x1 [0052.540] SetErrorMode (uMode=0x0) returned 0x1 [0052.540] GetFileType (hFile=0x440) returned 0x1 [0052.540] WriteFile (in: hFile=0x440, lpBuffer=0x2b9ff88*, nNumberOfBytesToWrite=0x5220, lpNumberOfBytesWritten=0x8fe924, lpOverlapped=0x0 | out: lpBuffer=0x2b9ff88*, lpNumberOfBytesWritten=0x8fe924*=0x5220, lpOverlapped=0x0) returned 1 [0052.541] GetLastError () returned 0x0 [0052.542] CloseHandle (hObject=0x440) returned 1 [0052.542] GetLastError () returned 0x0 [0052.542] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml", lpFilePart=0x0) returned 0x72 [0052.542] GetLastError () returned 0x0 [0052.542] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\masterdescriptor.x-none.xml")) returned 1 [0052.543] GetLastError () returned 0x0 [0052.549] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16", lpFilePart=0x0) returned 0x56 [0052.549] GetLastError () returned 0x0 [0052.549] SetErrorMode (uMode=0x1) returned 0x0 [0052.549] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xceaf7d72, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6060 [0052.549] GetLastError () returned 0x0 [0052.549] FindNextFileW (in: hFindFile=0x9f6060, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xceaf7d72, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.549] GetLastError () returned 0x0 [0052.549] FindNextFileW (in: hFindFile=0x9f6060, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcead1a9b, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xcead1a9b, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xceaf7d72, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x5220, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.x-none.xml.ZY109leGlcJEDtp+OZgtcA==.bwall", cAlternateFileName="MASTER~1.BWA")) returned 1 [0052.549] GetLastError () returned 0x0 [0052.550] FindNextFileW (in: hFindFile=0x9f6060, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfe714e00, ftLastWriteTime.dwHighDateTime=0x1d0d7e7, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s640.hash", cAlternateFileName="S640~1.HAS")) returned 1 [0052.550] GetLastError () returned 0x0 [0052.550] FindNextFileW (in: hFindFile=0x9f6060, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfe714e00, ftLastWriteTime.dwHighDateTime=0x1d0d7e7, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0052.550] GetLastError () returned 0x0 [0052.550] FindNextFileW (in: hFindFile=0x9f6060, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfe714e00, ftLastWriteTime.dwHighDateTime=0x1d0d7e7, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0052.550] GetLastError () returned 0x12 [0052.550] FindClose (in: hFindFile=0x9f6060 | out: hFindFile=0x9f6060) returned 1 [0052.550] SetErrorMode (uMode=0x0) returned 0x1 [0052.552] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe3dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x69 [0052.552] GetLastError () returned 0x12 [0052.552] SetErrorMode (uMode=0x1) returned 0x0 [0052.552] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x440 [0052.552] GetLastError () returned 0x0 [0052.552] GetFileType (hFile=0x440) returned 0x1 [0052.552] SetErrorMode (uMode=0x0) returned 0x1 [0052.552] GetFileType (hFile=0x440) returned 0x1 [0052.553] WriteFile (in: hFile=0x440, lpBuffer=0x2bb7930*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe934, lpOverlapped=0x0 | out: lpBuffer=0x2bb7930*, lpNumberOfBytesWritten=0x8fe934*=0xbcb, lpOverlapped=0x0) returned 1 [0052.554] GetLastError () returned 0x0 [0052.554] CloseHandle (hObject=0x440) returned 1 [0052.554] GetLastError () returned 0x0 [0052.555] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x5f [0052.555] GetLastError () returned 0x0 [0052.555] SetErrorMode (uMode=0x1) returned 0x0 [0052.555] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x440 [0052.555] GetLastError () returned 0x0 [0052.556] GetFileType (hFile=0x440) returned 0x1 [0052.556] SetErrorMode (uMode=0x0) returned 0x1 [0052.556] GetFileType (hFile=0x440) returned 0x1 [0052.556] WriteFile (in: hFile=0x440, lpBuffer=0x2bbe698*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe968, lpOverlapped=0x0 | out: lpBuffer=0x2bbe698*, lpNumberOfBytesWritten=0x8fe968*=0xbcb, lpOverlapped=0x0) returned 1 [0052.557] GetLastError () returned 0x0 [0052.557] CloseHandle (hObject=0x440) returned 1 [0052.557] GetLastError () returned 0x0 [0052.557] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData", lpFilePart=0x0) returned 0x33 [0052.557] GetLastError () returned 0x0 [0052.558] SetErrorMode (uMode=0x1) returned 0x0 [0052.558] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f67a0 [0052.558] GetLastError () returned 0x0 [0052.558] FindNextFileW (in: hFindFile=0x9f67a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.558] GetLastError () returned 0x0 [0052.558] FindNextFileW (in: hFindFile=0x9f67a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Catalog", cAlternateFileName="")) returned 1 [0052.558] GetLastError () returned 0x0 [0052.558] FindNextFileW (in: hFindFile=0x9f67a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 1 [0052.558] GetLastError () returned 0x0 [0052.559] FindNextFileW (in: hFindFile=0x9f67a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 0 [0052.559] GetLastError () returned 0x12 [0052.559] FindClose (in: hFindFile=0x9f67a0 | out: hFindFile=0x9f67a0) returned 1 [0052.559] SetErrorMode (uMode=0x0) returned 0x1 [0052.559] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData", lpFilePart=0x0) returned 0x33 [0052.559] GetLastError () returned 0x12 [0052.559] SetErrorMode (uMode=0x1) returned 0x0 [0052.559] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f65a0 [0052.560] GetLastError () returned 0x12 [0052.560] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.560] GetLastError () returned 0x12 [0052.560] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Catalog", cAlternateFileName="")) returned 1 [0052.560] GetLastError () returned 0x12 [0052.560] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 1 [0052.560] GetLastError () returned 0x12 [0052.560] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 0 [0052.560] GetLastError () returned 0x12 [0052.561] FindClose (in: hFindFile=0x9f65a0 | out: hFindFile=0x9f65a0) returned 1 [0052.561] SetErrorMode (uMode=0x0) returned 0x1 [0052.561] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog", lpFilePart=0x0) returned 0x3b [0052.561] GetLastError () returned 0x12 [0052.561] SetErrorMode (uMode=0x1) returned 0x0 [0052.561] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f66a0 [0052.561] GetLastError () returned 0x12 [0052.561] FindNextFileW (in: hFindFile=0x9f66a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.561] GetLastError () returned 0x12 [0052.561] FindNextFileW (in: hFindFile=0x9f66a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 1 [0052.561] GetLastError () returned 0x12 [0052.562] FindNextFileW (in: hFindFile=0x9f66a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 0 [0052.562] GetLastError () returned 0x12 [0052.562] FindClose (in: hFindFile=0x9f66a0 | out: hFindFile=0x9f66a0) returned 1 [0052.562] SetErrorMode (uMode=0x0) returned 0x1 [0052.562] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog", lpFilePart=0x0) returned 0x3b [0052.562] GetLastError () returned 0x12 [0052.562] SetErrorMode (uMode=0x1) returned 0x0 [0052.562] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f61a0 [0052.562] GetLastError () returned 0x12 [0052.562] FindNextFileW (in: hFindFile=0x9f61a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.562] GetLastError () returned 0x12 [0052.563] FindNextFileW (in: hFindFile=0x9f61a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 1 [0052.563] GetLastError () returned 0x12 [0052.563] FindNextFileW (in: hFindFile=0x9f61a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 0 [0052.563] GetLastError () returned 0x12 [0052.563] FindClose (in: hFindFile=0x9f61a0 | out: hFindFile=0x9f61a0) returned 1 [0052.563] SetErrorMode (uMode=0x0) returned 0x1 [0052.563] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages", nBufferLength=0x105, lpBuffer=0x8fe46c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages", lpFilePart=0x0) returned 0x44 [0052.563] GetLastError () returned 0x12 [0052.563] SetErrorMode (uMode=0x1) returned 0x0 [0052.563] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f65e0 [0052.563] GetLastError () returned 0x12 [0052.564] FindNextFileW (in: hFindFile=0x9f65e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.564] GetLastError () returned 0x12 [0052.564] FindNextFileW (in: hFindFile=0x9f65e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47E8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 1 [0052.564] GetLastError () returned 0x12 [0052.564] FindNextFileW (in: hFindFile=0x9f65e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47E8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 0 [0052.564] GetLastError () returned 0x12 [0052.564] FindClose (in: hFindFile=0x9f65e0 | out: hFindFile=0x9f65e0) returned 1 [0052.564] SetErrorMode (uMode=0x0) returned 0x1 [0052.564] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages", nBufferLength=0x105, lpBuffer=0x8fe46c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages", lpFilePart=0x0) returned 0x44 [0052.564] GetLastError () returned 0x12 [0052.565] SetErrorMode (uMode=0x1) returned 0x0 [0052.565] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f65a0 [0052.565] GetLastError () returned 0x12 [0052.565] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.565] GetLastError () returned 0x12 [0052.566] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47E8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 1 [0052.566] GetLastError () returned 0x12 [0052.566] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47E8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 0 [0052.566] GetLastError () returned 0x12 [0052.566] FindClose (in: hFindFile=0x9f65a0 | out: hFindFile=0x9f65a0) returned 1 [0052.566] SetErrorMode (uMode=0x0) returned 0x1 [0052.566] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}", nBufferLength=0x105, lpBuffer=0x8fe438, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}", lpFilePart=0x0) returned 0x6b [0052.566] GetLastError () returned 0x12 [0052.566] SetErrorMode (uMode=0x1) returned 0x0 [0052.566] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f65a0 [0052.567] GetLastError () returned 0x12 [0052.567] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.567] GetLastError () returned 0x12 [0052.567] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3cb8e906, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3cb8e906, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{1A8308C7-90D1-4200-B16E-646F163A08E8}", cAlternateFileName="{1A830~1")) returned 1 [0052.567] GetLastError () returned 0x12 [0052.567] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3cb8e906, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3cb8e906, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{1A8308C7-90D1-4200-B16E-646F163A08E8}", cAlternateFileName="{1A830~1")) returned 0 [0052.567] GetLastError () returned 0x12 [0052.567] FindClose (in: hFindFile=0x9f65a0 | out: hFindFile=0x9f65a0) returned 1 [0052.574] SetErrorMode (uMode=0x0) returned 0x1 [0052.574] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}", nBufferLength=0x105, lpBuffer=0x8fe438, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}", lpFilePart=0x0) returned 0x6b [0052.574] GetLastError () returned 0x12 [0052.574] SetErrorMode (uMode=0x1) returned 0x0 [0052.574] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6060 [0052.574] GetLastError () returned 0x12 [0052.574] FindNextFileW (in: hFindFile=0x9f6060, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.574] GetLastError () returned 0x12 [0052.575] FindNextFileW (in: hFindFile=0x9f6060, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3cb8e906, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3cb8e906, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{1A8308C7-90D1-4200-B16E-646F163A08E8}", cAlternateFileName="{1A830~1")) returned 1 [0052.575] GetLastError () returned 0x12 [0052.575] FindNextFileW (in: hFindFile=0x9f6060, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3cb8e906, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3cb8e906, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{1A8308C7-90D1-4200-B16E-646F163A08E8}", cAlternateFileName="{1A830~1")) returned 0 [0052.575] GetLastError () returned 0x12 [0052.575] FindClose (in: hFindFile=0x9f6060 | out: hFindFile=0x9f6060) returned 1 [0052.575] SetErrorMode (uMode=0x0) returned 0x1 [0052.575] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}", nBufferLength=0x105, lpBuffer=0x8fe404, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}", lpFilePart=0x0) returned 0x92 [0052.575] GetLastError () returned 0x12 [0052.575] SetErrorMode (uMode=0x1) returned 0x0 [0052.576] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3cb8e906, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3cb8e906, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6120 [0052.576] GetLastError () returned 0x12 [0052.576] FindNextFileW (in: hFindFile=0x9f6120, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3cb8e906, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3cb8e906, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.576] GetLastError () returned 0x12 [0052.576] FindNextFileW (in: hFindFile=0x9f6120, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3c4670e0, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfiguration.xml", cAlternateFileName="DEPLOY~1.XML")) returned 1 [0052.576] GetLastError () returned 0x12 [0052.576] FindNextFileW (in: hFindFile=0x9f6120, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d6778e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9dfb986, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf9e9425d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x5ab2f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Manifest.xml", cAlternateFileName="")) returned 1 [0052.576] GetLastError () returned 0x12 [0052.577] FindNextFileW (in: hFindFile=0x9f6120, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8639b81c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf39b2ab6, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x3c4670e0, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserDeploymentConfiguration.xml", cAlternateFileName="USERDE~1.XML")) returned 1 [0052.577] GetLastError () returned 0x12 [0052.577] FindNextFileW (in: hFindFile=0x9f6120, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf36dde8c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x42b5f096, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x38e9a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserManifest.xml", cAlternateFileName="USERMA~1.XML")) returned 1 [0052.577] GetLastError () returned 0x12 [0052.577] FindNextFileW (in: hFindFile=0x9f6120, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf36dde8c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x42b5f096, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x38e9a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserManifest.xml", cAlternateFileName="USERMA~1.XML")) returned 0 [0052.577] GetLastError () returned 0x12 [0052.577] FindClose (in: hFindFile=0x9f6120 | out: hFindFile=0x9f6120) returned 1 [0052.577] SetErrorMode (uMode=0x0) returned 0x1 [0052.578] GetProcessWindowStation () returned 0x13c [0052.578] GetActiveWindow () returned 0x7002e [0052.578] GetCurrentActCtx (in: lphActCtx=0x8fe854 | out: lphActCtx=0x8fe854*=0x9f8cbc) returned 1 [0052.578] GetCurrentThreadId () returned 0x540 [0052.578] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c42ca, lParam=0x0) returned 1 [0052.578] IsWindowVisible (hWnd=0x7002e) returned 0 [0052.578] IsWindowVisible (hWnd=0x4020e) returned 0 [0052.579] IsWindowVisible (hWnd=0x60044) returned 0 [0052.579] IsWindowVisible (hWnd=0x2021a) returned 0 [0052.579] IsWindowVisible (hWnd=0x8004a) returned 0 [0052.579] GetActiveWindow () returned 0x7002e [0052.579] GetFocus () returned 0x7002e [0052.579] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0052.580] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0052.580] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0052.581] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0052.581] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0052.581] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0052.582] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0052.591] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x17020c) returned 0x1 [0052.591] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe10c) returned 0x0 [0052.591] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe10c) returned 0x0 [0052.758] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0052.766] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdf14) returned 0x0 [0052.766] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdf14) returned 0x0 [0052.766] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x17020c) returned 0x1 [0052.768] SetFocus (hWnd=0x7002e) returned 0x17020c [0052.770] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0052.771] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0052.771] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0052.776] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0052.776] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x17020c, lParam=0x0) returned 0x0 [0052.781] IsWindow (hWnd=0x7002e) returned 1 [0052.781] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0052.781] IsWindow (hWnd=0x7002e) returned 1 [0052.781] SetFocus (hWnd=0x7002e) returned 0x7002e [0052.781] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0052.781] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0052.781] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0052.782] GetProcessWindowStation () returned 0x13c [0052.782] GetActiveWindow () returned 0x7002e [0052.783] GetCurrentActCtx (in: lphActCtx=0x8fe854 | out: lphActCtx=0x8fe854*=0x9f8cbc) returned 1 [0052.783] GetCurrentThreadId () returned 0x540 [0052.783] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c435a, lParam=0x0) returned 1 [0052.784] IsWindowVisible (hWnd=0x7002e) returned 0 [0052.784] IsWindowVisible (hWnd=0x4020e) returned 0 [0052.784] IsWindowVisible (hWnd=0x60044) returned 0 [0052.784] IsWindowVisible (hWnd=0x2021a) returned 0 [0052.784] IsWindowVisible (hWnd=0x8004a) returned 0 [0052.784] GetActiveWindow () returned 0x7002e [0052.784] GetFocus () returned 0x7002e [0052.784] MessageBoxW (hWnd=0x7002e, lpText="VhSw9krH9ks1CRQf8rpo9w==", lpCaption="", uType=0x0) returned 1 [0052.786] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0052.786] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0052.787] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0052.788] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0052.788] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0052.788] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0052.794] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x18020c) returned 0x1 [0052.795] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe10c) returned 0x0 [0052.795] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe10c) returned 0x0 [0052.953] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0052.969] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdf14) returned 0x0 [0052.969] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdf14) returned 0x0 [0052.969] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x18020c) returned 0x1 [0052.971] SetFocus (hWnd=0x7002e) returned 0x18020c [0052.972] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0052.974] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0052.974] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0052.974] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0052.974] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x18020c, lParam=0x0) returned 0x0 [0052.981] IsWindow (hWnd=0x7002e) returned 1 [0052.981] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0052.981] IsWindow (hWnd=0x7002e) returned 1 [0052.981] SetFocus (hWnd=0x7002e) returned 0x7002e [0052.981] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0052.981] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0052.981] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0052.981] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml", nBufferLength=0x105, lpBuffer=0x8fe450, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml", lpFilePart=0x0) returned 0xae [0052.981] GetLastError () returned 0x0 [0052.981] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml", dwFileAttributes=0x80) returned 1 [0052.982] GetLastError () returned 0x0 [0052.982] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml", nBufferLength=0x105, lpBuffer=0x8fe320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml", lpFilePart=0x0) returned 0xae [0052.982] GetLastError () returned 0x0 [0052.982] SetErrorMode (uMode=0x1) returned 0x0 [0052.982] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\deploymentconfiguration.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0052.982] GetLastError () returned 0x0 [0052.982] GetFileType (hFile=0x440) returned 0x1 [0052.982] SetErrorMode (uMode=0x0) returned 0x1 [0052.982] GetFileType (hFile=0x440) returned 0x1 [0052.982] GetFileSize (in: hFile=0x440, lpFileSizeHigh=0x8fe8d4 | out: lpFileSizeHigh=0x8fe8d4*=0x0) returned 0x266 [0052.982] GetLastError () returned 0x0 [0052.983] ReadFile (in: hFile=0x440, lpBuffer=0x2bc72d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe87c, lpOverlapped=0x0 | out: lpBuffer=0x2bc72d0*, lpNumberOfBytesRead=0x8fe87c*=0x266, lpOverlapped=0x0) returned 1 [0052.983] GetLastError () returned 0x0 [0052.983] CloseHandle (hObject=0x440) returned 1 [0052.984] GetLastError () returned 0x0 [0052.984] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0052.984] GetLastError () returned 0x0 [0052.984] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe824 | out: phKey=0x8fe824*=0x9f65a0) returned 1 [0052.984] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0052.984] GetLastError () returned 0x0 [0052.984] CryptSetKeyParam (hKey=0x9f65a0, dwParam=0x4, pbData=0x2bc8344*=0x1, dwFlags=0x0) returned 1 [0052.984] GetLastError () returned 0x0 [0052.984] CryptSetKeyParam (hKey=0x9f65a0, dwParam=0x1, pbData=0x2bc8310, dwFlags=0x0) returned 1 [0052.984] GetLastError () returned 0x0 [0052.984] CryptEncrypt (in: hKey=0x9f65a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bc8354*, pdwDataLen=0x8fe8dc*=0x270, dwBufLen=0x270 | out: pbData=0x2bc8354*, pdwDataLen=0x8fe8dc*=0x270) returned 1 [0052.985] GetLastError () returned 0x0 [0052.985] CryptEncrypt (in: hKey=0x9f65a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2bc85e4*, pdwDataLen=0x8fe8e4*=0x0, dwBufLen=0x10 | out: pbData=0x2bc85e4*, pdwDataLen=0x8fe8e4*=0x10) returned 1 [0052.985] GetLastError () returned 0x0 [0052.985] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml", nBufferLength=0x105, lpBuffer=0x8fe328, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml", lpFilePart=0x0) returned 0xae [0052.985] GetLastError () returned 0x0 [0052.985] SetErrorMode (uMode=0x1) returned 0x0 [0052.985] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\deploymentconfiguration.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0052.986] GetLastError () returned 0xb7 [0052.986] GetFileType (hFile=0x440) returned 0x1 [0052.986] SetErrorMode (uMode=0x0) returned 0x1 [0052.986] GetFileType (hFile=0x440) returned 0x1 [0052.986] WriteFile (in: hFile=0x440, lpBuffer=0x2bc8b38*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x8fe850, lpOverlapped=0x0 | out: lpBuffer=0x2bc8b38*, lpNumberOfBytesWritten=0x8fe850*=0x270, lpOverlapped=0x0) returned 1 [0052.987] GetLastError () returned 0xb7 [0052.987] CloseHandle (hObject=0x440) returned 1 [0052.988] GetLastError () returned 0xb7 [0052.988] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml.VhSw9krH9ks1CRQf8rpo9w==.bwall", nBufferLength=0x105, lpBuffer=0x8fe328, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml.VhSw9krH9ks1CRQf8rpo9w==.bwall", lpFilePart=0x0) returned 0xcd [0052.988] GetLastError () returned 0xb7 [0052.988] SetErrorMode (uMode=0x1) returned 0x0 [0052.988] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml.VhSw9krH9ks1CRQf8rpo9w==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\deploymentconfiguration.xml.vhsw9krh9ks1crqf8rpo9w==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0052.988] GetLastError () returned 0x0 [0052.988] GetFileType (hFile=0x440) returned 0x1 [0052.988] SetErrorMode (uMode=0x0) returned 0x1 [0052.988] GetFileType (hFile=0x440) returned 0x1 [0052.989] WriteFile (in: hFile=0x440, lpBuffer=0x2bc9ed4*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x8fe850, lpOverlapped=0x0 | out: lpBuffer=0x2bc9ed4*, lpNumberOfBytesWritten=0x8fe850*=0x270, lpOverlapped=0x0) returned 1 [0052.990] GetLastError () returned 0x0 [0052.991] CloseHandle (hObject=0x440) returned 1 [0052.991] GetLastError () returned 0x0 [0052.993] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml", nBufferLength=0x105, lpBuffer=0x8fe44c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml", lpFilePart=0x0) returned 0xae [0052.993] GetLastError () returned 0x0 [0052.993] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\deploymentconfiguration.xml")) returned 1 [0052.994] GetLastError () returned 0x0 [0052.998] GetProcessWindowStation () returned 0x13c [0052.998] GetActiveWindow () returned 0x7002e [0052.999] GetCurrentActCtx (in: lphActCtx=0x8fe854 | out: lphActCtx=0x8fe854*=0x9f8cbc) returned 1 [0052.999] GetCurrentThreadId () returned 0x540 [0052.999] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c426a, lParam=0x0) returned 1 [0052.999] IsWindowVisible (hWnd=0x7002e) returned 0 [0052.999] IsWindowVisible (hWnd=0x4020e) returned 0 [0052.999] IsWindowVisible (hWnd=0x60044) returned 0 [0052.999] IsWindowVisible (hWnd=0x2021a) returned 0 [0052.999] IsWindowVisible (hWnd=0x8004a) returned 0 [0052.999] GetActiveWindow () returned 0x7002e [0052.999] GetFocus () returned 0x7002e [0053.000] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0053.000] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0053.001] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0053.001] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0053.002] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0053.002] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0053.002] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0053.012] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x19020c) returned 0x1 [0053.013] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe10c) returned 0x0 [0053.013] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe10c) returned 0x0 [0053.182] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0053.189] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdf14) returned 0x0 [0053.189] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdf14) returned 0x0 [0053.189] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x19020c) returned 0x1 [0053.190] SetFocus (hWnd=0x7002e) returned 0x19020c [0053.192] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0053.193] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0053.193] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0053.194] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0053.194] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x19020c, lParam=0x0) returned 0x0 [0053.198] IsWindow (hWnd=0x7002e) returned 1 [0053.198] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0053.198] IsWindow (hWnd=0x7002e) returned 1 [0053.198] SetFocus (hWnd=0x7002e) returned 0x7002e [0053.198] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0053.198] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0053.198] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0053.199] GetProcessWindowStation () returned 0x13c [0053.199] GetActiveWindow () returned 0x7002e [0053.199] GetCurrentActCtx (in: lphActCtx=0x8fe854 | out: lphActCtx=0x8fe854*=0x9f8cbc) returned 1 [0053.199] GetCurrentThreadId () returned 0x540 [0053.199] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c444a, lParam=0x0) returned 1 [0053.199] IsWindowVisible (hWnd=0x7002e) returned 0 [0053.199] IsWindowVisible (hWnd=0x4020e) returned 0 [0053.199] IsWindowVisible (hWnd=0x60044) returned 0 [0053.199] IsWindowVisible (hWnd=0x2021a) returned 0 [0053.200] IsWindowVisible (hWnd=0x8004a) returned 0 [0053.200] GetActiveWindow () returned 0x7002e [0053.200] GetFocus () returned 0x7002e [0053.200] MessageBoxW (hWnd=0x7002e, lpText="xuuUIV8+ZnMjKEvpvdccIA==", lpCaption="", uType=0x0) returned 1 [0053.201] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0053.201] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0053.202] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0053.202] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0053.202] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0053.202] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0053.209] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x1a020c) returned 0x1 [0053.213] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe10c) returned 0x0 [0053.213] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe10c) returned 0x0 [0053.358] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0053.372] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdf14) returned 0x0 [0053.372] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdf14) returned 0x0 [0053.372] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x1a020c) returned 0x1 [0053.373] SetFocus (hWnd=0x7002e) returned 0x1a020c [0053.375] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0053.377] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0053.377] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0053.377] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0053.377] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x1a020c, lParam=0x0) returned 0x0 [0053.391] IsWindow (hWnd=0x7002e) returned 1 [0053.391] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0053.391] IsWindow (hWnd=0x7002e) returned 1 [0053.391] SetFocus (hWnd=0x7002e) returned 0x7002e [0053.391] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0053.391] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0053.391] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0053.391] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml", nBufferLength=0x105, lpBuffer=0x8fe450, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml", lpFilePart=0x0) returned 0x9f [0053.391] GetLastError () returned 0x0 [0053.391] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml", dwFileAttributes=0x80) returned 1 [0053.392] GetLastError () returned 0x0 [0053.392] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml", nBufferLength=0x105, lpBuffer=0x8fe320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml", lpFilePart=0x0) returned 0x9f [0053.392] GetLastError () returned 0x0 [0053.392] SetErrorMode (uMode=0x1) returned 0x0 [0053.392] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\manifest.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0053.393] GetLastError () returned 0x0 [0053.393] GetFileType (hFile=0x440) returned 0x1 [0053.393] SetErrorMode (uMode=0x0) returned 0x1 [0053.393] GetFileType (hFile=0x440) returned 0x1 [0053.393] GetFileSize (in: hFile=0x440, lpFileSizeHigh=0x8fe8d4 | out: lpFileSizeHigh=0x8fe8d4*=0x0) returned 0x5ab2f7 [0053.393] GetLastError () returned 0x0 [0053.405] ReadFile (in: hFile=0x440, lpBuffer=0x3a18020, nNumberOfBytesToRead=0x5ab2f7, lpNumberOfBytesRead=0x8fe87c, lpOverlapped=0x0 | out: lpBuffer=0x3a18020*, lpNumberOfBytesRead=0x8fe87c*=0x5ab2f7, lpOverlapped=0x0) returned 1 [0053.606] GetLastError () returned 0x0 [0053.607] CloseHandle (hObject=0x440) returned 1 [0053.607] GetLastError () returned 0x0 [0053.607] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0053.607] GetLastError () returned 0x0 [0053.607] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe824 | out: phKey=0x8fe824*=0x9f65e0) returned 1 [0053.607] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0053.607] GetLastError () returned 0x0 [0053.607] CryptSetKeyParam (hKey=0x9f65e0, dwParam=0x4, pbData=0x2bcfe18*=0x1, dwFlags=0x0) returned 1 [0053.607] GetLastError () returned 0x0 [0053.607] CryptSetKeyParam (hKey=0x9f65e0, dwParam=0x1, pbData=0x2bcfde4, dwFlags=0x0) returned 1 [0053.607] GetLastError () returned 0x0 [0053.725] CryptEncrypt (in: hKey=0x9f65e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3fc3328*, pdwDataLen=0x8fe8dc*=0x5ab300, dwBufLen=0x5ab300 | out: pbData=0x3fc3328*, pdwDataLen=0x8fe8dc*=0x5ab300) returned 1 [0053.732] GetLastError () returned 0x0 [0053.732] CryptEncrypt (in: hKey=0x9f65e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2a39438*, pdwDataLen=0x8fe8e4*=0x0, dwBufLen=0x10 | out: pbData=0x2a39438*, pdwDataLen=0x8fe8e4*=0x10) returned 1 [0053.732] GetLastError () returned 0x0 [0053.732] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml", nBufferLength=0x105, lpBuffer=0x8fe328, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml", lpFilePart=0x0) returned 0x9f [0053.732] GetLastError () returned 0x0 [0053.732] SetErrorMode (uMode=0x1) returned 0x0 [0053.732] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\manifest.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0053.738] GetLastError () returned 0xb7 [0053.738] GetFileType (hFile=0x440) returned 0x1 [0053.738] SetErrorMode (uMode=0x0) returned 0x1 [0053.738] GetFileType (hFile=0x440) returned 0x1 [0053.739] WriteFile (in: hFile=0x440, lpBuffer=0x3fc3328*, nNumberOfBytesToWrite=0x5ab300, lpNumberOfBytesWritten=0x8fe888, lpOverlapped=0x0 | out: lpBuffer=0x3fc3328*, lpNumberOfBytesWritten=0x8fe888*=0x5ab300, lpOverlapped=0x0) returned 1 [0053.876] GetLastError () returned 0xb7 [0053.876] CloseHandle (hObject=0x440) returned 1 [0054.130] GetLastError () returned 0xb7 [0054.130] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml.xuuUIV8+ZnMjKEvpvdccIA==.bwall", nBufferLength=0x105, lpBuffer=0x8fe328, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml.xuuUIV8+ZnMjKEvpvdccIA==.bwall", lpFilePart=0x0) returned 0xbe [0054.131] GetLastError () returned 0xb7 [0054.131] SetErrorMode (uMode=0x1) returned 0x0 [0054.131] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml.xuuUIV8+ZnMjKEvpvdccIA==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\manifest.xml.xuuuiv8+znmjkevpvdccia==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0054.132] GetLastError () returned 0x0 [0054.132] GetFileType (hFile=0x440) returned 0x1 [0054.132] SetErrorMode (uMode=0x0) returned 0x1 [0054.132] GetFileType (hFile=0x440) returned 0x1 [0054.132] WriteFile (in: hFile=0x440, lpBuffer=0x3fc3328*, nNumberOfBytesToWrite=0x5ab300, lpNumberOfBytesWritten=0x8fe888, lpOverlapped=0x0 | out: lpBuffer=0x3fc3328*, lpNumberOfBytesWritten=0x8fe888*=0x5ab300, lpOverlapped=0x0) returned 1 [0054.337] GetLastError () returned 0x0 [0054.337] CloseHandle (hObject=0x440) returned 1 [0054.519] GetLastError () returned 0x0 [0054.519] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml", nBufferLength=0x105, lpBuffer=0x8fe44c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml", lpFilePart=0x0) returned 0x9f [0054.519] GetLastError () returned 0x0 [0054.519] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\manifest.xml")) returned 1 [0054.523] GetLastError () returned 0x0 [0054.528] GetProcessWindowStation () returned 0x13c [0054.528] GetActiveWindow () returned 0x7002e [0054.529] GetCurrentActCtx (in: lphActCtx=0x8fe854 | out: lphActCtx=0x8fe854*=0x9f8cbc) returned 1 [0054.529] GetCurrentThreadId () returned 0x540 [0054.529] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c429a, lParam=0x0) returned 1 [0054.529] IsWindowVisible (hWnd=0x7002e) returned 0 [0054.529] IsWindowVisible (hWnd=0x4020e) returned 0 [0054.529] IsWindowVisible (hWnd=0x60044) returned 0 [0054.529] IsWindowVisible (hWnd=0x2021a) returned 0 [0054.530] IsWindowVisible (hWnd=0x8004a) returned 0 [0054.530] GetActiveWindow () returned 0x7002e [0054.530] GetFocus () returned 0x7002e [0054.530] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0054.531] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0054.532] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0054.533] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0054.534] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0054.534] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0054.534] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0054.542] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x1b020c) returned 0x1 [0054.543] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe10c) returned 0x0 [0054.543] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe10c) returned 0x0 [0054.796] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0054.807] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdf14) returned 0x0 [0054.807] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdf14) returned 0x0 [0054.808] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x1b020c) returned 0x1 [0054.809] SetFocus (hWnd=0x7002e) returned 0x1b020c [0054.811] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0054.812] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0054.812] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0054.812] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0054.812] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x1b020c, lParam=0x0) returned 0x0 [0054.817] IsWindow (hWnd=0x7002e) returned 1 [0054.817] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0054.817] IsWindow (hWnd=0x7002e) returned 1 [0054.817] SetFocus (hWnd=0x7002e) returned 0x7002e [0054.817] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0054.817] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0054.817] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0054.818] GetProcessWindowStation () returned 0x13c [0054.818] GetActiveWindow () returned 0x7002e [0054.818] GetCurrentActCtx (in: lphActCtx=0x8fe854 | out: lphActCtx=0x8fe854*=0x9f8cbc) returned 1 [0054.818] GetCurrentThreadId () returned 0x540 [0054.818] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c43ea, lParam=0x0) returned 1 [0054.818] IsWindowVisible (hWnd=0x7002e) returned 0 [0054.820] IsWindowVisible (hWnd=0x4020e) returned 0 [0054.820] IsWindowVisible (hWnd=0x60044) returned 0 [0054.820] IsWindowVisible (hWnd=0x2021a) returned 0 [0054.821] IsWindowVisible (hWnd=0x8004a) returned 0 [0054.821] GetActiveWindow () returned 0x7002e [0054.821] GetFocus () returned 0x7002e [0054.821] MessageBoxW (hWnd=0x7002e, lpText="FRLi/a4tYfaeGQLOzr5Y9A==", lpCaption="", uType=0x0) returned 1 [0054.822] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0054.822] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0054.823] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0054.823] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0054.824] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0054.824] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0054.831] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x1c020c) returned 0x1 [0054.832] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe10c) returned 0x0 [0054.832] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe10c) returned 0x0 [0054.955] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0054.962] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdf14) returned 0x0 [0054.962] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdf14) returned 0x0 [0054.962] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x1c020c) returned 0x1 [0054.964] SetFocus (hWnd=0x7002e) returned 0x1c020c [0054.965] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0054.966] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0054.967] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0054.967] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0054.967] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x1c020c, lParam=0x0) returned 0x0 [0054.971] IsWindow (hWnd=0x7002e) returned 1 [0054.971] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0054.971] IsWindow (hWnd=0x7002e) returned 1 [0054.971] SetFocus (hWnd=0x7002e) returned 0x7002e [0054.971] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0054.971] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0054.971] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0054.971] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml", nBufferLength=0x105, lpBuffer=0x8fe450, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml", lpFilePart=0x0) returned 0xb2 [0054.971] GetLastError () returned 0x0 [0054.972] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml", dwFileAttributes=0x80) returned 1 [0054.972] GetLastError () returned 0x0 [0054.972] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml", nBufferLength=0x105, lpBuffer=0x8fe320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml", lpFilePart=0x0) returned 0xb2 [0054.972] GetLastError () returned 0x0 [0054.972] SetErrorMode (uMode=0x1) returned 0x0 [0054.972] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\userdeploymentconfiguration.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0054.972] GetLastError () returned 0x0 [0054.973] GetFileType (hFile=0x440) returned 0x1 [0054.973] SetErrorMode (uMode=0x0) returned 0x1 [0054.973] GetFileType (hFile=0x440) returned 0x1 [0054.973] GetFileSize (in: hFile=0x440, lpFileSizeHigh=0x8fe8d4 | out: lpFileSizeHigh=0x8fe8d4*=0x0) returned 0x266 [0054.973] GetLastError () returned 0x0 [0054.973] ReadFile (in: hFile=0x440, lpBuffer=0x2a3ef10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe87c, lpOverlapped=0x0 | out: lpBuffer=0x2a3ef10*, lpNumberOfBytesRead=0x8fe87c*=0x266, lpOverlapped=0x0) returned 1 [0054.974] GetLastError () returned 0x0 [0054.974] CloseHandle (hObject=0x440) returned 1 [0054.974] GetLastError () returned 0x0 [0054.974] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0054.974] GetLastError () returned 0x0 [0054.974] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe824 | out: phKey=0x8fe824*=0x9f5860) returned 1 [0054.974] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0054.974] GetLastError () returned 0x0 [0054.974] CryptSetKeyParam (hKey=0x9f5860, dwParam=0x4, pbData=0x2a3ff84*=0x1, dwFlags=0x0) returned 1 [0054.974] GetLastError () returned 0x0 [0054.974] CryptSetKeyParam (hKey=0x9f5860, dwParam=0x1, pbData=0x2a3ff50, dwFlags=0x0) returned 1 [0054.974] GetLastError () returned 0x0 [0054.974] CryptEncrypt (in: hKey=0x9f5860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2a3ff94*, pdwDataLen=0x8fe8dc*=0x270, dwBufLen=0x270 | out: pbData=0x2a3ff94*, pdwDataLen=0x8fe8dc*=0x270) returned 1 [0054.974] GetLastError () returned 0x0 [0054.974] CryptEncrypt (in: hKey=0x9f5860, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2a40224*, pdwDataLen=0x8fe8e4*=0x0, dwBufLen=0x10 | out: pbData=0x2a40224*, pdwDataLen=0x8fe8e4*=0x10) returned 1 [0054.978] GetLastError () returned 0x0 [0054.978] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml", nBufferLength=0x105, lpBuffer=0x8fe328, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml", lpFilePart=0x0) returned 0xb2 [0054.978] GetLastError () returned 0x0 [0054.978] SetErrorMode (uMode=0x1) returned 0x0 [0054.978] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\userdeploymentconfiguration.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0054.979] GetLastError () returned 0xb7 [0054.979] GetFileType (hFile=0x440) returned 0x1 [0054.979] SetErrorMode (uMode=0x0) returned 0x1 [0054.979] GetFileType (hFile=0x440) returned 0x1 [0054.979] WriteFile (in: hFile=0x440, lpBuffer=0x2a407d4*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x8fe850, lpOverlapped=0x0 | out: lpBuffer=0x2a407d4*, lpNumberOfBytesWritten=0x8fe850*=0x270, lpOverlapped=0x0) returned 1 [0054.981] GetLastError () returned 0xb7 [0054.981] CloseHandle (hObject=0x440) returned 1 [0054.982] GetLastError () returned 0xb7 [0054.982] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml.FRLi#a4tYfaeGQLOzr5Y9A==.bwall", nBufferLength=0x105, lpBuffer=0x8fe328, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml.FRLi#a4tYfaeGQLOzr5Y9A==.bwall", lpFilePart=0x0) returned 0xd1 [0054.982] GetLastError () returned 0xb7 [0054.982] SetErrorMode (uMode=0x1) returned 0x0 [0054.982] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml.FRLi#a4tYfaeGQLOzr5Y9A==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\userdeploymentconfiguration.xml.frli#a4tyfaegqlozr5y9a==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0054.982] GetLastError () returned 0x0 [0054.982] GetFileType (hFile=0x440) returned 0x1 [0054.982] SetErrorMode (uMode=0x0) returned 0x1 [0054.983] GetFileType (hFile=0x440) returned 0x1 [0054.983] WriteFile (in: hFile=0x440, lpBuffer=0x2a41b80*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x8fe850, lpOverlapped=0x0 | out: lpBuffer=0x2a41b80*, lpNumberOfBytesWritten=0x8fe850*=0x270, lpOverlapped=0x0) returned 1 [0054.983] GetLastError () returned 0x0 [0054.984] CloseHandle (hObject=0x440) returned 1 [0054.984] GetLastError () returned 0x0 [0054.984] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml", nBufferLength=0x105, lpBuffer=0x8fe44c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml", lpFilePart=0x0) returned 0xb2 [0054.984] GetLastError () returned 0x0 [0054.984] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\userdeploymentconfiguration.xml")) returned 1 [0054.985] GetLastError () returned 0x0 [0054.989] GetProcessWindowStation () returned 0x13c [0054.989] GetActiveWindow () returned 0x7002e [0054.989] GetCurrentActCtx (in: lphActCtx=0x8fe854 | out: lphActCtx=0x8fe854*=0x9f8cbc) returned 1 [0054.989] GetCurrentThreadId () returned 0x540 [0054.989] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c42ca, lParam=0x0) returned 1 [0054.990] IsWindowVisible (hWnd=0x7002e) returned 0 [0054.990] IsWindowVisible (hWnd=0x4020e) returned 0 [0054.990] IsWindowVisible (hWnd=0x60044) returned 0 [0054.990] IsWindowVisible (hWnd=0x2021a) returned 0 [0054.990] IsWindowVisible (hWnd=0x8004a) returned 0 [0054.990] GetActiveWindow () returned 0x7002e [0054.990] GetFocus () returned 0x7002e [0054.990] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0054.991] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0054.991] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0054.992] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0054.992] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0054.993] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0054.993] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0054.999] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x1d020c) returned 0x1 [0055.000] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe10c) returned 0x0 [0055.000] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe10c) returned 0x0 [0055.155] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0055.164] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdf14) returned 0x0 [0055.164] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdf14) returned 0x0 [0055.164] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x1d020c) returned 0x1 [0055.165] SetFocus (hWnd=0x7002e) returned 0x1d020c [0055.167] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0055.168] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0055.169] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0055.169] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0055.169] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x1d020c, lParam=0x0) returned 0x0 [0055.173] IsWindow (hWnd=0x7002e) returned 1 [0055.173] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0055.173] IsWindow (hWnd=0x7002e) returned 1 [0055.173] SetFocus (hWnd=0x7002e) returned 0x7002e [0055.174] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0055.174] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0055.174] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0055.174] GetProcessWindowStation () returned 0x13c [0055.174] GetActiveWindow () returned 0x7002e [0055.174] GetCurrentActCtx (in: lphActCtx=0x8fe854 | out: lphActCtx=0x8fe854*=0x9f8cbc) returned 1 [0055.174] GetCurrentThreadId () returned 0x540 [0055.175] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c441a, lParam=0x0) returned 1 [0055.175] IsWindowVisible (hWnd=0x7002e) returned 0 [0055.175] IsWindowVisible (hWnd=0x4020e) returned 0 [0055.175] IsWindowVisible (hWnd=0x60044) returned 0 [0055.175] IsWindowVisible (hWnd=0x2021a) returned 0 [0055.175] IsWindowVisible (hWnd=0x8004a) returned 0 [0055.175] GetActiveWindow () returned 0x7002e [0055.176] GetFocus () returned 0x7002e [0055.176] MessageBoxW (hWnd=0x7002e, lpText="ZHW5a4TBt9Kl+NV7O0PXBQ==", lpCaption="", uType=0x0) returned 1 [0055.177] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0055.177] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0055.180] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0055.180] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0055.180] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0055.181] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0055.187] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x1e020c) returned 0x1 [0055.188] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe10c) returned 0x0 [0055.188] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe10c) returned 0x0 [0055.506] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0055.517] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdf14) returned 0x0 [0055.517] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdf14) returned 0x0 [0055.517] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x1e020c) returned 0x1 [0055.518] SetFocus (hWnd=0x7002e) returned 0x1e020c [0055.520] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0055.521] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0055.521] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0055.521] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0055.521] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x1e020c, lParam=0x0) returned 0x0 [0055.528] IsWindow (hWnd=0x7002e) returned 1 [0055.528] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0055.528] IsWindow (hWnd=0x7002e) returned 1 [0055.528] SetFocus (hWnd=0x7002e) returned 0x7002e [0055.529] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0055.529] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0055.529] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0055.529] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml", nBufferLength=0x105, lpBuffer=0x8fe450, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml", lpFilePart=0x0) returned 0xa3 [0055.529] GetLastError () returned 0x0 [0055.529] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml", dwFileAttributes=0x80) returned 1 [0055.530] GetLastError () returned 0x0 [0055.530] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml", nBufferLength=0x105, lpBuffer=0x8fe320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml", lpFilePart=0x0) returned 0xa3 [0055.530] GetLastError () returned 0x0 [0055.530] SetErrorMode (uMode=0x1) returned 0x0 [0055.531] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\usermanifest.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0055.531] GetLastError () returned 0x0 [0055.531] GetFileType (hFile=0x440) returned 0x1 [0055.531] SetErrorMode (uMode=0x0) returned 0x1 [0055.531] GetFileType (hFile=0x440) returned 0x1 [0055.531] GetFileSize (in: hFile=0x440, lpFileSizeHigh=0x8fe8d4 | out: lpFileSizeHigh=0x8fe8d4*=0x0) returned 0x38e9a8 [0055.531] GetLastError () returned 0x0 [0055.607] ReadFile (in: hFile=0x440, lpBuffer=0x3a18010, nNumberOfBytesToRead=0x38e9a8, lpNumberOfBytesRead=0x8fe87c, lpOverlapped=0x0 | out: lpBuffer=0x3a18010*, lpNumberOfBytesRead=0x8fe87c*=0x38e9a8, lpOverlapped=0x0) returned 1 [0055.749] GetLastError () returned 0x0 [0055.749] CloseHandle (hObject=0x440) returned 1 [0055.749] GetLastError () returned 0x0 [0055.749] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0055.749] GetLastError () returned 0x0 [0055.750] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe824 | out: phKey=0x8fe824*=0x9f5860) returned 1 [0055.750] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0055.750] GetLastError () returned 0x0 [0055.750] CryptSetKeyParam (hKey=0x9f5860, dwParam=0x4, pbData=0x2a47af0*=0x1, dwFlags=0x0) returned 1 [0055.750] GetLastError () returned 0x0 [0055.750] CryptSetKeyParam (hKey=0x9f5860, dwParam=0x1, pbData=0x2a47abc, dwFlags=0x0) returned 1 [0055.750] GetLastError () returned 0x0 [0055.805] CryptEncrypt (in: hKey=0x9f5860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3da69c8*, pdwDataLen=0x8fe8dc*=0x38e9b0, dwBufLen=0x38e9b0 | out: pbData=0x3da69c8*, pdwDataLen=0x8fe8dc*=0x38e9b0) returned 1 [0055.809] GetLastError () returned 0x0 [0055.809] CryptEncrypt (in: hKey=0x9f5860, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2a47b10*, pdwDataLen=0x8fe8e4*=0x0, dwBufLen=0x10 | out: pbData=0x2a47b10*, pdwDataLen=0x8fe8e4*=0x10) returned 1 [0055.809] GetLastError () returned 0x0 [0055.810] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml", nBufferLength=0x105, lpBuffer=0x8fe328, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml", lpFilePart=0x0) returned 0xa3 [0055.810] GetLastError () returned 0x0 [0055.810] SetErrorMode (uMode=0x1) returned 0x0 [0055.810] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\usermanifest.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0055.829] GetLastError () returned 0xb7 [0055.829] GetFileType (hFile=0x440) returned 0x1 [0055.829] SetErrorMode (uMode=0x0) returned 0x1 [0055.829] GetFileType (hFile=0x440) returned 0x1 [0055.830] WriteFile (in: hFile=0x440, lpBuffer=0x3da69c8*, nNumberOfBytesToWrite=0x38e9b0, lpNumberOfBytesWritten=0x8fe888, lpOverlapped=0x0 | out: lpBuffer=0x3da69c8*, lpNumberOfBytesWritten=0x8fe888*=0x38e9b0, lpOverlapped=0x0) returned 1 [0056.087] GetLastError () returned 0xb7 [0056.087] CloseHandle (hObject=0x440) returned 1 [0056.213] GetLastError () returned 0xb7 [0056.213] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml.ZHW5a4TBt9Kl+NV7O0PXBQ==.bwall", nBufferLength=0x105, lpBuffer=0x8fe328, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml.ZHW5a4TBt9Kl+NV7O0PXBQ==.bwall", lpFilePart=0x0) returned 0xc2 [0056.213] GetLastError () returned 0xb7 [0056.213] SetErrorMode (uMode=0x1) returned 0x0 [0056.213] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml.ZHW5a4TBt9Kl+NV7O0PXBQ==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\usermanifest.xml.zhw5a4tbt9kl+nv7o0pxbq==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x440 [0056.214] GetLastError () returned 0x0 [0056.214] GetFileType (hFile=0x440) returned 0x1 [0056.214] SetErrorMode (uMode=0x0) returned 0x1 [0056.214] GetFileType (hFile=0x440) returned 0x1 [0056.214] WriteFile (in: hFile=0x440, lpBuffer=0x3da69c8*, nNumberOfBytesToWrite=0x38e9b0, lpNumberOfBytesWritten=0x8fe888, lpOverlapped=0x0 | out: lpBuffer=0x3da69c8*, lpNumberOfBytesWritten=0x8fe888*=0x38e9b0, lpOverlapped=0x0) returned 1 [0056.356] GetLastError () returned 0x0 [0056.356] CloseHandle (hObject=0x440) returned 1 [0056.447] GetLastError () returned 0x0 [0056.447] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml", nBufferLength=0x105, lpBuffer=0x8fe44c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml", lpFilePart=0x0) returned 0xa3 [0056.447] GetLastError () returned 0x0 [0056.448] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\usermanifest.xml")) returned 1 [0056.453] GetLastError () returned 0x0 [0056.457] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}", nBufferLength=0x105, lpBuffer=0x8fe404, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}", lpFilePart=0x0) returned 0x92 [0056.457] GetLastError () returned 0x0 [0056.457] SetErrorMode (uMode=0x1) returned 0x0 [0056.458] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3cb8e906, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0xd1040e69, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f5ba0 [0056.458] GetLastError () returned 0x0 [0056.458] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3cb8e906, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0xd1040e69, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.458] GetLastError () returned 0x0 [0056.458] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcef23eed, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xcef23eed, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xcef4a118, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x270, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfiguration.xml.VhSw9krH9ks1CRQf8rpo9w==.bwall", cAlternateFileName="DEPLOY~1.BWA")) returned 1 [0056.458] GetLastError () returned 0x0 [0056.458] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfa2af7c, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xcfa2af7c, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xcfddcf37, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x5ab300, dwReserved0=0x0, dwReserved1=0x0, cFileName="Manifest.xml.xuuUIV8+ZnMjKEvpvdccIA==.bwall", cAlternateFileName="MANIFE~1.BWA")) returned 1 [0056.458] GetLastError () returned 0x0 [0056.459] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0236cd1, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xd0236cd1, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xd0236cd1, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x270, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserDeploymentConfiguration.xml.FRLi#a4tYfaeGQLOzr5Y9A==.bwall", cAlternateFileName="USERDE~1.BWA")) returned 1 [0056.459] GetLastError () returned 0x0 [0056.459] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0e04d9e, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xd0e04d9e, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xd1040e69, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x38e9b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserManifest.xml.ZHW5a4TBt9Kl+NV7O0PXBQ==.bwall", cAlternateFileName="USERMA~1.BWA")) returned 1 [0056.459] GetLastError () returned 0x0 [0056.490] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0e04d9e, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xd0e04d9e, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xd1040e69, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x38e9b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserManifest.xml.ZHW5a4TBt9Kl+NV7O0PXBQ==.bwall", cAlternateFileName="USERMA~1.BWA")) returned 0 [0056.491] GetLastError () returned 0x12 [0056.491] FindClose (in: hFindFile=0x9f5ba0 | out: hFindFile=0x9f5ba0) returned 1 [0056.491] SetErrorMode (uMode=0x0) returned 0x1 [0056.492] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe340, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\README-BW-gffL.txt", lpFilePart=0x0) returned 0xa5 [0056.492] GetLastError () returned 0x12 [0056.492] SetErrorMode (uMode=0x1) returned 0x0 [0056.492] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x440 [0056.492] GetLastError () returned 0x0 [0056.492] GetFileType (hFile=0x440) returned 0x1 [0056.492] SetErrorMode (uMode=0x0) returned 0x1 [0056.492] GetFileType (hFile=0x440) returned 0x1 [0056.492] WriteFile (in: hFile=0x440, lpBuffer=0x2a521c8*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe898, lpOverlapped=0x0 | out: lpBuffer=0x2a521c8*, lpNumberOfBytesWritten=0x8fe898*=0xbcb, lpOverlapped=0x0) returned 1 [0056.493] GetLastError () returned 0x0 [0056.493] CloseHandle (hObject=0x440) returned 1 [0056.494] GetLastError () returned 0x0 [0056.494] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe374, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x7e [0056.494] GetLastError () returned 0x0 [0056.494] SetErrorMode (uMode=0x1) returned 0x0 [0056.494] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x440 [0056.494] GetLastError () returned 0x0 [0056.494] GetFileType (hFile=0x440) returned 0x1 [0056.495] SetErrorMode (uMode=0x0) returned 0x1 [0056.495] GetFileType (hFile=0x440) returned 0x1 [0056.495] WriteFile (in: hFile=0x440, lpBuffer=0x2a58fac*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe8cc, lpOverlapped=0x0 | out: lpBuffer=0x2a58fac*, lpNumberOfBytesWritten=0x8fe8cc*=0xbcb, lpOverlapped=0x0) returned 1 [0056.496] GetLastError () returned 0x0 [0056.496] CloseHandle (hObject=0x440) returned 1 [0056.496] GetLastError () returned 0x0 [0056.496] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe3a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x57 [0056.496] GetLastError () returned 0x0 [0056.496] SetErrorMode (uMode=0x1) returned 0x0 [0056.496] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x440 [0056.497] GetLastError () returned 0x0 [0056.497] GetFileType (hFile=0x440) returned 0x1 [0056.497] SetErrorMode (uMode=0x0) returned 0x1 [0056.498] GetFileType (hFile=0x440) returned 0x1 [0056.498] WriteFile (in: hFile=0x440, lpBuffer=0x2a5fcf4*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe900, lpOverlapped=0x0 | out: lpBuffer=0x2a5fcf4*, lpNumberOfBytesWritten=0x8fe900*=0xbcb, lpOverlapped=0x0) returned 1 [0056.498] GetLastError () returned 0x0 [0056.499] CloseHandle (hObject=0x440) returned 1 [0056.499] GetLastError () returned 0x0 [0056.499] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe3dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x4e [0056.499] GetLastError () returned 0x0 [0056.499] SetErrorMode (uMode=0x1) returned 0x0 [0056.499] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x440 [0056.500] GetLastError () returned 0x0 [0056.500] GetFileType (hFile=0x440) returned 0x1 [0056.500] SetErrorMode (uMode=0x0) returned 0x1 [0056.500] GetFileType (hFile=0x440) returned 0x1 [0056.500] WriteFile (in: hFile=0x440, lpBuffer=0x2a66a18*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe934, lpOverlapped=0x0 | out: lpBuffer=0x2a66a18*, lpNumberOfBytesWritten=0x8fe934*=0xbcb, lpOverlapped=0x0) returned 1 [0056.501] GetLastError () returned 0x0 [0056.501] CloseHandle (hObject=0x440) returned 1 [0056.501] GetLastError () returned 0x0 [0056.501] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration", lpFilePart=0x0) returned 0x3f [0056.501] GetLastError () returned 0x0 [0056.501] SetErrorMode (uMode=0x1) returned 0x0 [0056.501] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f5ba0 [0056.501] GetLastError () returned 0x0 [0056.501] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.502] GetLastError () returned 0x0 [0056.502] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShortcutBackups", cAlternateFileName="SHORTC~1")) returned 1 [0056.502] GetLastError () returned 0x0 [0056.502] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShortcutBackups", cAlternateFileName="SHORTC~1")) returned 0 [0056.502] GetLastError () returned 0x12 [0056.502] FindClose (in: hFindFile=0x9f5ba0 | out: hFindFile=0x9f5ba0) returned 1 [0056.502] SetErrorMode (uMode=0x0) returned 0x1 [0056.502] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration", lpFilePart=0x0) returned 0x3f [0056.502] GetLastError () returned 0x12 [0056.502] SetErrorMode (uMode=0x1) returned 0x0 [0056.502] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f5ba0 [0056.503] GetLastError () returned 0x12 [0056.503] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.503] GetLastError () returned 0x12 [0056.503] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShortcutBackups", cAlternateFileName="SHORTC~1")) returned 1 [0056.503] GetLastError () returned 0x12 [0056.503] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShortcutBackups", cAlternateFileName="SHORTC~1")) returned 0 [0056.503] GetLastError () returned 0x12 [0056.503] FindClose (in: hFindFile=0x9f5ba0 | out: hFindFile=0x9f5ba0) returned 1 [0056.503] SetErrorMode (uMode=0x0) returned 0x1 [0056.503] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups", nBufferLength=0x105, lpBuffer=0x8fe46c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups", lpFilePart=0x0) returned 0x4f [0056.503] GetLastError () returned 0x12 [0056.504] SetErrorMode (uMode=0x1) returned 0x0 [0056.504] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f5ba0 [0056.504] GetLastError () returned 0x12 [0056.504] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.504] GetLastError () returned 0x12 [0056.504] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0056.504] GetLastError () returned 0x12 [0056.504] FindClose (in: hFindFile=0x9f5ba0 | out: hFindFile=0x9f5ba0) returned 1 [0056.504] SetErrorMode (uMode=0x0) returned 0x1 [0056.504] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups", nBufferLength=0x105, lpBuffer=0x8fe46c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups", lpFilePart=0x0) returned 0x4f [0056.504] GetLastError () returned 0x12 [0056.504] SetErrorMode (uMode=0x1) returned 0x0 [0056.505] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f5ba0 [0056.505] GetLastError () returned 0x12 [0056.505] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.505] GetLastError () returned 0x12 [0056.505] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0056.505] GetLastError () returned 0x12 [0056.505] FindClose (in: hFindFile=0x9f5ba0 | out: hFindFile=0x9f5ba0) returned 1 [0056.505] SetErrorMode (uMode=0x0) returned 0x1 [0056.506] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe3a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x62 [0056.506] GetLastError () returned 0x12 [0056.506] SetErrorMode (uMode=0x1) returned 0x0 [0056.506] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\integration\\shortcutbackups\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x440 [0056.506] GetLastError () returned 0x0 [0056.506] GetFileType (hFile=0x440) returned 0x1 [0056.506] SetErrorMode (uMode=0x0) returned 0x1 [0056.507] GetFileType (hFile=0x440) returned 0x1 [0056.507] WriteFile (in: hFile=0x440, lpBuffer=0x2a6f654*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe900, lpOverlapped=0x0 | out: lpBuffer=0x2a6f654*, lpNumberOfBytesWritten=0x8fe900*=0xbcb, lpOverlapped=0x0) returned 1 [0056.507] GetLastError () returned 0x0 [0056.508] CloseHandle (hObject=0x440) returned 1 [0056.508] GetLastError () returned 0x0 [0056.509] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe3dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x52 [0056.509] GetLastError () returned 0x0 [0056.509] SetErrorMode (uMode=0x1) returned 0x0 [0056.509] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\integration\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x440 [0056.509] GetLastError () returned 0x0 [0056.509] GetFileType (hFile=0x440) returned 0x1 [0056.509] SetErrorMode (uMode=0x0) returned 0x1 [0056.509] GetFileType (hFile=0x440) returned 0x1 [0056.509] WriteFile (in: hFile=0x440, lpBuffer=0x2a76388*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe934, lpOverlapped=0x0 | out: lpBuffer=0x2a76388*, lpNumberOfBytesWritten=0x8fe934*=0xbcb, lpOverlapped=0x0) returned 1 [0056.510] GetLastError () returned 0x0 [0056.510] CloseHandle (hObject=0x440) returned 1 [0056.510] GetLastError () returned 0x0 [0056.511] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x46 [0056.511] GetLastError () returned 0x0 [0056.511] SetErrorMode (uMode=0x1) returned 0x0 [0056.511] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x440 [0056.512] GetLastError () returned 0x0 [0056.512] GetFileType (hFile=0x440) returned 0x1 [0056.512] SetErrorMode (uMode=0x0) returned 0x1 [0056.512] GetFileType (hFile=0x440) returned 0x1 [0056.512] WriteFile (in: hFile=0x440, lpBuffer=0x2a7d08c*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe968, lpOverlapped=0x0 | out: lpBuffer=0x2a7d08c*, lpNumberOfBytesWritten=0x8fe968*=0xbcb, lpOverlapped=0x0) returned 1 [0056.513] GetLastError () returned 0x0 [0056.513] CloseHandle (hObject=0x440) returned 1 [0056.513] GetLastError () returned 0x0 [0056.513] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases", lpFilePart=0x0) returned 0x37 [0056.513] GetLastError () returned 0x0 [0056.513] SetErrorMode (uMode=0x1) returned 0x0 [0056.513] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8826bb5f, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x683c4eba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x683c4eba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f5ba0 [0056.515] GetLastError () returned 0x0 [0056.516] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8826bb5f, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x683c4eba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x683c4eba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.516] GetLastError () returned 0x0 [0056.516] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bad881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a320d06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a320d06, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5A65C4D7-3CDF-4BE4-8560-F036D300C13F", cAlternateFileName="5A65C4~1")) returned 1 [0056.516] GetLastError () returned 0x0 [0056.516] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A6A87302-92AE-41F2-AC52-73F5EE18259F", cAlternateFileName="A6A873~1")) returned 1 [0056.516] GetLastError () returned 0x0 [0056.516] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A6A87302-92AE-41F2-AC52-73F5EE18259F", cAlternateFileName="A6A873~1")) returned 0 [0056.516] GetLastError () returned 0x12 [0056.517] FindClose (in: hFindFile=0x9f5ba0 | out: hFindFile=0x9f5ba0) returned 1 [0056.517] SetErrorMode (uMode=0x0) returned 0x1 [0056.517] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases", lpFilePart=0x0) returned 0x37 [0056.517] GetLastError () returned 0x12 [0056.517] SetErrorMode (uMode=0x1) returned 0x0 [0056.517] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8826bb5f, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x683c4eba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x683c4eba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f5ba0 [0056.518] GetLastError () returned 0x12 [0056.518] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8826bb5f, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x683c4eba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x683c4eba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.518] GetLastError () returned 0x12 [0056.518] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bad881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a320d06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a320d06, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5A65C4D7-3CDF-4BE4-8560-F036D300C13F", cAlternateFileName="5A65C4~1")) returned 1 [0056.519] GetLastError () returned 0x12 [0056.519] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A6A87302-92AE-41F2-AC52-73F5EE18259F", cAlternateFileName="A6A873~1")) returned 1 [0056.519] GetLastError () returned 0x12 [0056.519] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A6A87302-92AE-41F2-AC52-73F5EE18259F", cAlternateFileName="A6A873~1")) returned 0 [0056.519] GetLastError () returned 0x12 [0056.519] FindClose (in: hFindFile=0x9f5ba0 | out: hFindFile=0x9f5ba0) returned 1 [0056.520] SetErrorMode (uMode=0x0) returned 0x1 [0056.520] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F", lpFilePart=0x0) returned 0x5c [0056.520] GetLastError () returned 0x12 [0056.520] SetErrorMode (uMode=0x1) returned 0x0 [0056.520] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bad881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a320d06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a320d06, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f5ba0 [0056.521] GetLastError () returned 0x12 [0056.521] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bad881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a320d06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a320d06, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.521] GetLastError () returned 0x12 [0056.521] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a320d06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a49e573, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1 [0056.521] GetLastError () returned 0x12 [0056.522] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0056.522] GetLastError () returned 0x12 [0056.522] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0056.522] GetLastError () returned 0x12 [0056.522] FindClose (in: hFindFile=0x9f5ba0 | out: hFindFile=0x9f5ba0) returned 1 [0056.522] SetErrorMode (uMode=0x0) returned 0x1 [0056.522] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F", lpFilePart=0x0) returned 0x5c [0056.522] GetLastError () returned 0x12 [0056.522] SetErrorMode (uMode=0x1) returned 0x0 [0056.522] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bad881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a320d06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a320d06, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f5ba0 [0056.522] GetLastError () returned 0x12 [0056.523] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bad881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a320d06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a320d06, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.523] GetLastError () returned 0x12 [0056.523] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a320d06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a49e573, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1 [0056.523] GetLastError () returned 0x12 [0056.523] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0056.523] GetLastError () returned 0x12 [0056.523] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0056.523] GetLastError () returned 0x12 [0056.523] FindClose (in: hFindFile=0x9f5ba0 | out: hFindFile=0x9f5ba0) returned 1 [0056.523] SetErrorMode (uMode=0x0) returned 0x1 [0056.524] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16", nBufferLength=0x105, lpBuffer=0x8fe46c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16", lpFilePart=0x0) returned 0x65 [0056.524] GetLastError () returned 0x12 [0056.524] SetErrorMode (uMode=0x1) returned 0x0 [0056.524] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a320d06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a49e573, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f5ba0 [0056.526] GetLastError () returned 0x12 [0056.526] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a320d06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a49e573, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.526] GetLastError () returned 0x12 [0056.526] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a346f8d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a346f8d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd19cd600, ftLastWriteTime.dwHighDateTime=0x1d32052, nFileSizeHigh=0x0, nFileSizeLow=0x5bec, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0056.526] GetLastError () returned 0x12 [0056.526] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a36d2e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a36d2e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x918a2300, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s321033.hash", cAlternateFileName="S32103~1.HAS")) returned 1 [0056.526] GetLastError () returned 0x12 [0056.526] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a36d2e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a36d2e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x918a2300, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x1dff67, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.Platform.Culture.man.xml", cAlternateFileName="STREAM~1.XML")) returned 1 [0056.527] GetLastError () returned 0x12 [0056.527] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a49e573, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x80, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.en-us.hash", cAlternateFileName="STREAM~1.HAS")) returned 1 [0056.527] GetLastError () returned 0x12 [0056.527] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a49e573, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0056.527] GetLastError () returned 0x12 [0056.527] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a49e573, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0056.527] GetLastError () returned 0x12 [0056.527] FindClose (in: hFindFile=0x9f5ba0 | out: hFindFile=0x9f5ba0) returned 1 [0056.528] SetErrorMode (uMode=0x0) returned 0x1 [0056.530] GetProcessWindowStation () returned 0x13c [0056.530] GetActiveWindow () returned 0x7002e [0056.530] GetCurrentActCtx (in: lphActCtx=0x8fe8bc | out: lphActCtx=0x8fe8bc*=0x9f8cbc) returned 1 [0056.530] GetCurrentThreadId () returned 0x540 [0056.531] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c435a, lParam=0x0) returned 1 [0056.531] IsWindowVisible (hWnd=0x7002e) returned 0 [0056.531] IsWindowVisible (hWnd=0x4020e) returned 0 [0056.531] IsWindowVisible (hWnd=0x60044) returned 0 [0056.531] IsWindowVisible (hWnd=0x2021a) returned 0 [0056.531] IsWindowVisible (hWnd=0x8004a) returned 0 [0056.531] GetActiveWindow () returned 0x7002e [0056.531] GetFocus () returned 0x7002e [0056.531] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0056.533] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0056.533] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0056.534] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0056.534] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0056.534] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0056.535] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0056.541] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x1f020c) returned 0x1 [0056.542] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe174) returned 0x0 [0056.542] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe174) returned 0x0 [0059.706] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe4ac) returned 0x0 [0059.706] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe4ac) returned 0x0 [0059.708] GetWindowPlacement (in: hWnd=0x7002e, lpwndpl=0x8fe1e8 | out: lpwndpl=0x8fe1e8) returned 1 [0059.709] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x47, wParam=0x0, lParam=0x8fe4ac) returned 0x0 [0059.709] GetClientRect (in: hWnd=0x7002e, lpRect=0x8fe184 | out: lpRect=0x8fe184) returned 1 [0059.709] GetWindowRect (in: hWnd=0x7002e, lpRect=0x8fe184 | out: lpRect=0x8fe184) returned 1 [0059.709] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x47, wParam=0x0, lParam=0x8fe4ac) returned 0x0 [0059.714] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x1c, wParam=0x0, lParam=0x6cc) returned 0x0 [0059.714] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1c, wParam=0x0, lParam=0x6cc) returned 0x0 [0059.714] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x1c, wParam=0x0, lParam=0x6cc) returned 0x0 [0061.744] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe4ac) returned 0x0 [0061.745] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe4ac) returned 0x0 [0061.748] GetWindowPlacement (in: hWnd=0x7002e, lpwndpl=0x8fe1e8 | out: lpwndpl=0x8fe1e8) returned 1 [0061.748] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x47, wParam=0x0, lParam=0x8fe4ac) returned 0x0 [0061.748] GetClientRect (in: hWnd=0x7002e, lpRect=0x8fe184 | out: lpRect=0x8fe184) returned 1 [0061.748] GetWindowRect (in: hWnd=0x7002e, lpRect=0x8fe184 | out: lpRect=0x8fe184) returned 1 [0061.752] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x47, wParam=0x0, lParam=0x8fe4ac) returned 0x0 [0061.753] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0061.753] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0061.753] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0061.762] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0061.771] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdf7c) returned 0x0 [0061.771] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdf7c) returned 0x0 [0061.771] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x1f020c) returned 0x1 [0061.773] SetFocus (hWnd=0x7002e) returned 0x1f020c [0061.774] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0061.776] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0061.776] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0061.776] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0061.776] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x1f020c, lParam=0x0) returned 0x0 [0061.788] IsWindow (hWnd=0x7002e) returned 1 [0061.788] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0061.788] IsWindow (hWnd=0x7002e) returned 1 [0061.788] SetFocus (hWnd=0x7002e) returned 0x7002e [0061.788] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0061.788] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0061.788] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0061.790] GetProcessWindowStation () returned 0x13c [0061.790] GetActiveWindow () returned 0x7002e [0061.790] GetCurrentActCtx (in: lphActCtx=0x8fe8bc | out: lphActCtx=0x8fe8bc*=0x9f8cbc) returned 1 [0061.790] GetCurrentThreadId () returned 0x540 [0061.791] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c429a, lParam=0x0) returned 1 [0061.792] IsWindowVisible (hWnd=0x7002e) returned 0 [0061.792] IsWindowVisible (hWnd=0x4020e) returned 0 [0061.792] IsWindowVisible (hWnd=0x60044) returned 0 [0061.792] IsWindowVisible (hWnd=0x2021a) returned 0 [0061.792] IsWindowVisible (hWnd=0x8004a) returned 0 [0061.792] GetActiveWindow () returned 0x7002e [0061.792] GetFocus () returned 0x7002e [0061.793] MessageBoxW (hWnd=0x7002e, lpText="cyTT5rn6VtVJpSOVTwDM9w==", lpCaption="", uType=0x0) returned 1 [0061.794] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0061.795] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0061.797] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0061.797] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0061.797] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0061.798] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0061.805] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x20020c) returned 0x1 [0061.806] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe174) returned 0x0 [0061.806] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe174) returned 0x0 [0062.101] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0062.111] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdf7c) returned 0x0 [0062.111] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdf7c) returned 0x0 [0062.111] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x20020c) returned 0x1 [0062.112] SetFocus (hWnd=0x7002e) returned 0x20020c [0062.114] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0062.115] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0062.116] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0062.116] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0062.116] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x20020c, lParam=0x0) returned 0x0 [0062.121] IsWindow (hWnd=0x7002e) returned 1 [0062.121] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0062.121] IsWindow (hWnd=0x7002e) returned 1 [0062.121] SetFocus (hWnd=0x7002e) returned 0x7002e [0062.121] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0062.121] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0062.121] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0062.121] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml", lpFilePart=0x0) returned 0x80 [0062.121] GetLastError () returned 0x0 [0062.121] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml", dwFileAttributes=0x80) returned 1 [0062.137] GetLastError () returned 0x0 [0062.138] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe388, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml", lpFilePart=0x0) returned 0x80 [0062.138] GetLastError () returned 0x0 [0062.138] SetErrorMode (uMode=0x1) returned 0x0 [0062.138] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\masterdescriptor.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0062.138] GetLastError () returned 0x0 [0062.138] GetFileType (hFile=0x444) returned 0x1 [0062.138] SetErrorMode (uMode=0x0) returned 0x1 [0062.138] GetFileType (hFile=0x444) returned 0x1 [0062.138] GetFileSize (in: hFile=0x444, lpFileSizeHigh=0x8fe93c | out: lpFileSizeHigh=0x8fe93c*=0x0) returned 0x5bec [0062.139] GetLastError () returned 0x0 [0062.139] ReadFile (in: hFile=0x444, lpBuffer=0x2a83718, nNumberOfBytesToRead=0x5bec, lpNumberOfBytesRead=0x8fe8e4, lpOverlapped=0x0 | out: lpBuffer=0x2a83718*, lpNumberOfBytesRead=0x8fe8e4*=0x5bec, lpOverlapped=0x0) returned 1 [0062.141] GetLastError () returned 0x0 [0062.142] CloseHandle (hObject=0x444) returned 1 [0062.142] GetLastError () returned 0x0 [0062.142] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0062.142] GetLastError () returned 0x0 [0062.142] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe88c | out: phKey=0x8fe88c*=0x9f5ba0) returned 1 [0062.143] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0062.143] GetLastError () returned 0x0 [0062.143] CryptSetKeyParam (hKey=0x9f5ba0, dwParam=0x4, pbData=0x2a89378*=0x1, dwFlags=0x0) returned 1 [0062.143] GetLastError () returned 0x0 [0062.143] CryptSetKeyParam (hKey=0x9f5ba0, dwParam=0x1, pbData=0x2a89344, dwFlags=0x0) returned 1 [0062.143] GetLastError () returned 0x0 [0062.143] CryptEncrypt (in: hKey=0x9f5ba0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2a89388*, pdwDataLen=0x8fe944*=0x5bf0, dwBufLen=0x5bf0 | out: pbData=0x2a89388*, pdwDataLen=0x8fe944*=0x5bf0) returned 1 [0062.144] GetLastError () returned 0x0 [0062.144] CryptEncrypt (in: hKey=0x9f5ba0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2a8ef98*, pdwDataLen=0x8fe94c*=0x0, dwBufLen=0x10 | out: pbData=0x2a8ef98*, pdwDataLen=0x8fe94c*=0x10) returned 1 [0062.144] GetLastError () returned 0x0 [0062.144] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe390, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml", lpFilePart=0x0) returned 0x80 [0062.144] GetLastError () returned 0x0 [0062.144] SetErrorMode (uMode=0x1) returned 0x0 [0062.144] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\masterdescriptor.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0062.145] GetLastError () returned 0xb7 [0062.145] GetFileType (hFile=0x444) returned 0x1 [0062.145] SetErrorMode (uMode=0x0) returned 0x1 [0062.145] GetFileType (hFile=0x444) returned 0x1 [0062.145] WriteFile (in: hFile=0x444, lpBuffer=0x2a89388*, nNumberOfBytesToWrite=0x5bf0, lpNumberOfBytesWritten=0x8fe8f0, lpOverlapped=0x0 | out: lpBuffer=0x2a89388*, lpNumberOfBytesWritten=0x8fe8f0*=0x5bf0, lpOverlapped=0x0) returned 1 [0062.146] GetLastError () returned 0xb7 [0062.147] CloseHandle (hObject=0x444) returned 1 [0062.149] GetLastError () returned 0xb7 [0062.149] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml.cyTT5rn6VtVJpSOVTwDM9w==.bwall", nBufferLength=0x105, lpBuffer=0x8fe390, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml.cyTT5rn6VtVJpSOVTwDM9w==.bwall", lpFilePart=0x0) returned 0x9f [0062.149] GetLastError () returned 0xb7 [0062.149] SetErrorMode (uMode=0x1) returned 0x0 [0062.149] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml.cyTT5rn6VtVJpSOVTwDM9w==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\masterdescriptor.en-us.xml.cytt5rn6vtvjpsovtwdm9w==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0062.150] GetLastError () returned 0x0 [0062.150] GetFileType (hFile=0x444) returned 0x1 [0062.150] SetErrorMode (uMode=0x0) returned 0x1 [0062.150] GetFileType (hFile=0x444) returned 0x1 [0062.150] WriteFile (in: hFile=0x444, lpBuffer=0x2a89388*, nNumberOfBytesToWrite=0x5bf0, lpNumberOfBytesWritten=0x8fe8f0, lpOverlapped=0x0 | out: lpBuffer=0x2a89388*, lpNumberOfBytesWritten=0x8fe8f0*=0x5bf0, lpOverlapped=0x0) returned 1 [0062.151] GetLastError () returned 0x0 [0062.151] CloseHandle (hObject=0x444) returned 1 [0062.152] GetLastError () returned 0x0 [0062.152] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe4b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml", lpFilePart=0x0) returned 0x80 [0062.152] GetLastError () returned 0x0 [0062.152] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\masterdescriptor.en-us.xml")) returned 1 [0062.153] GetLastError () returned 0x0 [0062.180] GetProcessWindowStation () returned 0x13c [0062.180] GetActiveWindow () returned 0x7002e [0062.180] GetCurrentActCtx (in: lphActCtx=0x8fe8bc | out: lphActCtx=0x8fe8bc*=0x9f8cbc) returned 1 [0062.180] GetCurrentThreadId () returned 0x540 [0062.181] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c44da, lParam=0x0) returned 1 [0062.182] IsWindowVisible (hWnd=0x7002e) returned 0 [0062.182] IsWindowVisible (hWnd=0x4020e) returned 0 [0062.182] IsWindowVisible (hWnd=0x60044) returned 0 [0062.182] IsWindowVisible (hWnd=0x2021a) returned 0 [0062.182] IsWindowVisible (hWnd=0x8004a) returned 0 [0062.182] GetActiveWindow () returned 0x7002e [0062.183] GetFocus () returned 0x7002e [0062.183] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0062.184] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0062.187] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0062.187] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0062.188] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0062.188] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0062.188] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0062.195] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x21020c) returned 0x1 [0062.196] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe174) returned 0x0 [0062.196] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe174) returned 0x0 [0062.344] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0062.406] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdf7c) returned 0x0 [0062.406] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdf7c) returned 0x0 [0062.406] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x21020c) returned 0x1 [0062.407] SetFocus (hWnd=0x7002e) returned 0x21020c [0062.410] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0062.411] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0062.411] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0062.411] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0062.411] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x21020c, lParam=0x0) returned 0x0 [0062.416] IsWindow (hWnd=0x7002e) returned 1 [0062.416] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0062.416] IsWindow (hWnd=0x7002e) returned 1 [0062.416] SetFocus (hWnd=0x7002e) returned 0x7002e [0062.417] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0062.417] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0062.417] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0062.417] GetProcessWindowStation () returned 0x13c [0062.417] GetActiveWindow () returned 0x7002e [0062.417] GetCurrentActCtx (in: lphActCtx=0x8fe8bc | out: lphActCtx=0x8fe8bc*=0x9f8cbc) returned 1 [0062.417] GetCurrentThreadId () returned 0x540 [0062.418] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c450a, lParam=0x0) returned 1 [0062.418] IsWindowVisible (hWnd=0x7002e) returned 0 [0062.418] IsWindowVisible (hWnd=0x4020e) returned 0 [0062.418] IsWindowVisible (hWnd=0x60044) returned 0 [0062.418] IsWindowVisible (hWnd=0x2021a) returned 0 [0062.418] IsWindowVisible (hWnd=0x8004a) returned 0 [0062.418] GetActiveWindow () returned 0x7002e [0062.418] GetFocus () returned 0x7002e [0062.419] MessageBoxW (hWnd=0x7002e, lpText="YIJMdgICCwiSQrQHbuO4zA==", lpCaption="", uType=0x0) returned 1 [0062.420] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0062.420] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0062.423] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0062.423] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0062.423] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0062.424] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0062.430] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x22020c) returned 0x1 [0062.431] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe174) returned 0x0 [0062.431] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe174) returned 0x0 [0062.705] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0062.712] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdf7c) returned 0x0 [0062.712] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdf7c) returned 0x0 [0062.712] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x22020c) returned 0x1 [0062.714] SetFocus (hWnd=0x7002e) returned 0x22020c [0062.715] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0062.717] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0062.717] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0062.721] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0062.721] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x22020c, lParam=0x0) returned 0x0 [0062.725] IsWindow (hWnd=0x7002e) returned 1 [0062.725] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0062.725] IsWindow (hWnd=0x7002e) returned 1 [0062.725] SetFocus (hWnd=0x7002e) returned 0x7002e [0062.725] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0062.725] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0062.725] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0062.725] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml", nBufferLength=0x105, lpBuffer=0x8fe4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml", lpFilePart=0x0) returned 0x85 [0062.725] GetLastError () returned 0x0 [0062.726] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml", dwFileAttributes=0x80) returned 1 [0062.727] GetLastError () returned 0x0 [0062.727] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml", nBufferLength=0x105, lpBuffer=0x8fe388, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml", lpFilePart=0x0) returned 0x85 [0062.727] GetLastError () returned 0x0 [0062.727] SetErrorMode (uMode=0x1) returned 0x0 [0062.728] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.platform.culture.man.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0062.728] GetLastError () returned 0x0 [0062.728] GetFileType (hFile=0x444) returned 0x1 [0062.728] SetErrorMode (uMode=0x0) returned 0x1 [0062.728] GetFileType (hFile=0x444) returned 0x1 [0062.728] GetFileSize (in: hFile=0x444, lpFileSizeHigh=0x8fe93c | out: lpFileSizeHigh=0x8fe93c*=0x0) returned 0x1dff67 [0062.728] GetLastError () returned 0x0 [0062.733] ReadFile (in: hFile=0x444, lpBuffer=0x4135398, nNumberOfBytesToRead=0x1dff67, lpNumberOfBytesRead=0x8fe8e4, lpOverlapped=0x0 | out: lpBuffer=0x4135398*, lpNumberOfBytesRead=0x8fe8e4*=0x1dff67, lpOverlapped=0x0) returned 1 [0062.784] GetLastError () returned 0x0 [0062.784] CloseHandle (hObject=0x444) returned 1 [0062.784] GetLastError () returned 0x0 [0062.784] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0062.784] GetLastError () returned 0x0 [0062.784] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe88c | out: phKey=0x8fe88c*=0x9f60a0) returned 1 [0062.785] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0062.785] GetLastError () returned 0x0 [0062.785] CryptSetKeyParam (hKey=0x9f60a0, dwParam=0x4, pbData=0x2a989cc*=0x1, dwFlags=0x0) returned 1 [0062.785] GetLastError () returned 0x0 [0062.785] CryptSetKeyParam (hKey=0x9f60a0, dwParam=0x1, pbData=0x2a98998, dwFlags=0x0) returned 1 [0062.785] GetLastError () returned 0x0 [0062.828] CryptEncrypt (in: hKey=0x9f60a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x4315320*, pdwDataLen=0x8fe944*=0x1dff70, dwBufLen=0x1dff70 | out: pbData=0x4315320*, pdwDataLen=0x8fe944*=0x1dff70) returned 1 [0062.831] GetLastError () returned 0x0 [0062.831] CryptEncrypt (in: hKey=0x9f60a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2a989f0*, pdwDataLen=0x8fe94c*=0x0, dwBufLen=0x10 | out: pbData=0x2a989f0*, pdwDataLen=0x8fe94c*=0x10) returned 1 [0062.831] GetLastError () returned 0x0 [0062.831] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml", nBufferLength=0x105, lpBuffer=0x8fe390, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml", lpFilePart=0x0) returned 0x85 [0062.831] GetLastError () returned 0x0 [0062.831] SetErrorMode (uMode=0x1) returned 0x0 [0062.831] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.platform.culture.man.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0062.839] GetLastError () returned 0xb7 [0062.839] GetFileType (hFile=0x444) returned 0x1 [0062.839] SetErrorMode (uMode=0x0) returned 0x1 [0062.839] GetFileType (hFile=0x444) returned 0x1 [0062.839] WriteFile (in: hFile=0x444, lpBuffer=0x4315320*, nNumberOfBytesToWrite=0x1dff70, lpNumberOfBytesWritten=0x8fe8f0, lpOverlapped=0x0 | out: lpBuffer=0x4315320*, lpNumberOfBytesWritten=0x8fe8f0*=0x1dff70, lpOverlapped=0x0) returned 1 [0062.877] GetLastError () returned 0xb7 [0062.877] CloseHandle (hObject=0x444) returned 1 [0062.917] GetLastError () returned 0xb7 [0062.917] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml.YIJMdgICCwiSQrQHbuO4zA==.bwall", nBufferLength=0x105, lpBuffer=0x8fe390, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml.YIJMdgICCwiSQrQHbuO4zA==.bwall", lpFilePart=0x0) returned 0xa4 [0062.917] GetLastError () returned 0xb7 [0062.917] SetErrorMode (uMode=0x1) returned 0x0 [0062.917] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml.YIJMdgICCwiSQrQHbuO4zA==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.platform.culture.man.xml.yijmdgiccwisqrqhbuo4za==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0062.917] GetLastError () returned 0x0 [0062.917] GetFileType (hFile=0x444) returned 0x1 [0062.917] SetErrorMode (uMode=0x0) returned 0x1 [0062.918] GetFileType (hFile=0x444) returned 0x1 [0062.918] WriteFile (in: hFile=0x444, lpBuffer=0x4315320*, nNumberOfBytesToWrite=0x1dff70, lpNumberOfBytesWritten=0x8fe8f0, lpOverlapped=0x0 | out: lpBuffer=0x4315320*, lpNumberOfBytesWritten=0x8fe8f0*=0x1dff70, lpOverlapped=0x0) returned 1 [0063.178] GetLastError () returned 0x0 [0063.178] CloseHandle (hObject=0x444) returned 1 [0063.218] GetLastError () returned 0x0 [0063.218] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml", nBufferLength=0x105, lpBuffer=0x8fe4b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml", lpFilePart=0x0) returned 0x85 [0063.218] GetLastError () returned 0x0 [0063.219] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.platform.culture.man.xml")) returned 1 [0063.234] GetLastError () returned 0x0 [0063.239] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16", nBufferLength=0x105, lpBuffer=0x8fe46c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16", lpFilePart=0x0) returned 0x65 [0063.239] GetLastError () returned 0x0 [0063.239] SetErrorMode (uMode=0x1) returned 0x0 [0063.239] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a320d06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd50d3631, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6660 [0063.239] GetLastError () returned 0x0 [0063.239] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a320d06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd50d3631, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.240] GetLastError () returned 0x0 [0063.240] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4689df2, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xd4689df2, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xd4689df2, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x5bf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.en-us.xml.cyTT5rn6VtVJpSOVTwDM9w==.bwall", cAlternateFileName="MASTER~1.BWA")) returned 1 [0063.240] GetLastError () returned 0x0 [0063.240] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a36d2e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a36d2e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x918a2300, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s321033.hash", cAlternateFileName="S32103~1.HAS")) returned 1 [0063.240] GetLastError () returned 0x0 [0063.240] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4dd7283, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xd4dd7283, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xd50d3631, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x1dff70, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.Platform.Culture.man.xml.YIJMdgICCwiSQrQHbuO4zA==.bwall", cAlternateFileName="STREAM~1.BWA")) returned 1 [0063.240] GetLastError () returned 0x0 [0063.240] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a49e573, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x80, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.en-us.hash", cAlternateFileName="STREAM~1.HAS")) returned 1 [0063.240] GetLastError () returned 0x0 [0063.241] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a49e573, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0063.241] GetLastError () returned 0x0 [0063.241] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a49e573, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0063.241] GetLastError () returned 0x12 [0063.241] FindClose (in: hFindFile=0x9f6660 | out: hFindFile=0x9f6660) returned 1 [0063.241] SetErrorMode (uMode=0x0) returned 0x1 [0063.242] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe3a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x78 [0063.242] GetLastError () returned 0x12 [0063.242] SetErrorMode (uMode=0x1) returned 0x0 [0063.242] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x444 [0063.243] GetLastError () returned 0x0 [0063.243] GetFileType (hFile=0x444) returned 0x1 [0063.243] SetErrorMode (uMode=0x0) returned 0x1 [0063.243] GetFileType (hFile=0x444) returned 0x1 [0063.243] WriteFile (in: hFile=0x444, lpBuffer=0x2aab40c*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe900, lpOverlapped=0x0 | out: lpBuffer=0x2aab40c*, lpNumberOfBytesWritten=0x8fe900*=0xbcb, lpOverlapped=0x0) returned 1 [0063.244] GetLastError () returned 0x0 [0063.244] CloseHandle (hObject=0x444) returned 1 [0063.244] GetLastError () returned 0x0 [0063.244] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16", nBufferLength=0x105, lpBuffer=0x8fe46c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16", lpFilePart=0x0) returned 0x66 [0063.244] GetLastError () returned 0x0 [0063.244] SetErrorMode (uMode=0x1) returned 0x0 [0063.244] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6660 [0063.246] GetLastError () returned 0x0 [0063.246] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.246] GetLastError () returned 0x0 [0063.246] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19bd39c1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdd889800, ftLastWriteTime.dwHighDateTime=0x1d32052, nFileSizeHigh=0x0, nFileSizeLow=0x5b31, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0063.246] GetLastError () returned 0x0 [0063.247] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19bf9d35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19bf9d35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6aa2800, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s320.hash", cAlternateFileName="S320~1.HAS")) returned 1 [0063.247] GetLastError () returned 0x0 [0063.247] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19bf9d35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19bf9d35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6aa2800, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x7e0a5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.Platform.x-none.man.xml", cAlternateFileName="STREAM~1.XML")) returned 1 [0063.247] GetLastError () returned 0x0 [0063.247] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19fffcc2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19fffcc2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x316a100, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x80, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.x-none.hash", cAlternateFileName="STREAM~1.HAS")) returned 1 [0063.247] GetLastError () returned 0x0 [0063.247] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19fffcc2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19fffcc2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0063.247] GetLastError () returned 0x0 [0063.248] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19fffcc2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19fffcc2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0063.248] GetLastError () returned 0x12 [0063.248] FindClose (in: hFindFile=0x9f6660 | out: hFindFile=0x9f6660) returned 1 [0063.249] SetErrorMode (uMode=0x0) returned 0x1 [0063.249] GetProcessWindowStation () returned 0x13c [0063.249] GetActiveWindow () returned 0x7002e [0063.249] GetCurrentActCtx (in: lphActCtx=0x8fe8bc | out: lphActCtx=0x8fe8bc*=0x9f8cbc) returned 1 [0063.249] GetCurrentThreadId () returned 0x540 [0063.249] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c42fa, lParam=0x0) returned 1 [0063.250] IsWindowVisible (hWnd=0x7002e) returned 0 [0063.250] IsWindowVisible (hWnd=0x4020e) returned 0 [0063.250] IsWindowVisible (hWnd=0x60044) returned 0 [0063.250] IsWindowVisible (hWnd=0x2021a) returned 0 [0063.250] IsWindowVisible (hWnd=0x8004a) returned 0 [0063.250] GetActiveWindow () returned 0x7002e [0063.250] GetFocus () returned 0x7002e [0063.250] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0063.251] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0063.252] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0063.253] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0063.253] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0063.253] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0063.254] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0063.261] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x23020c) returned 0x1 [0063.261] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe174) returned 0x0 [0063.262] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe174) returned 0x0 [0063.385] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0063.431] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdf7c) returned 0x0 [0063.431] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdf7c) returned 0x0 [0063.431] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x23020c) returned 0x1 [0063.433] SetFocus (hWnd=0x7002e) returned 0x23020c [0063.435] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0063.438] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0063.438] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0063.439] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0063.439] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x23020c, lParam=0x0) returned 0x0 [0063.444] IsWindow (hWnd=0x7002e) returned 1 [0063.444] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0063.444] IsWindow (hWnd=0x7002e) returned 1 [0063.444] SetFocus (hWnd=0x7002e) returned 0x7002e [0063.445] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0063.445] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0063.445] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0063.445] GetProcessWindowStation () returned 0x13c [0063.445] GetActiveWindow () returned 0x7002e [0063.445] GetCurrentActCtx (in: lphActCtx=0x8fe8bc | out: lphActCtx=0x8fe8bc*=0x9f8cbc) returned 1 [0063.445] GetCurrentThreadId () returned 0x540 [0063.445] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c453a, lParam=0x0) returned 1 [0063.446] IsWindowVisible (hWnd=0x7002e) returned 0 [0063.446] IsWindowVisible (hWnd=0x4020e) returned 0 [0063.446] IsWindowVisible (hWnd=0x60044) returned 0 [0063.446] IsWindowVisible (hWnd=0x2021a) returned 0 [0063.446] IsWindowVisible (hWnd=0x8004a) returned 0 [0063.446] GetActiveWindow () returned 0x7002e [0063.446] GetFocus () returned 0x7002e [0063.446] MessageBoxW (hWnd=0x7002e, lpText="Hr477yxJfm+N8NBYbP64Aw==", lpCaption="", uType=0x0) returned 1 [0063.447] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0063.448] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0063.448] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0063.449] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0063.449] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0063.449] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0063.458] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x24020c) returned 0x1 [0063.459] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe174) returned 0x0 [0063.459] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe174) returned 0x0 [0063.566] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0063.573] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdf7c) returned 0x0 [0063.573] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdf7c) returned 0x0 [0063.574] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x24020c) returned 0x1 [0063.575] SetFocus (hWnd=0x7002e) returned 0x24020c [0063.577] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0063.578] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0063.578] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0063.579] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0063.579] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x24020c, lParam=0x0) returned 0x0 [0063.583] IsWindow (hWnd=0x7002e) returned 1 [0063.583] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0063.583] IsWindow (hWnd=0x7002e) returned 1 [0063.583] SetFocus (hWnd=0x7002e) returned 0x7002e [0063.583] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0063.583] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0063.584] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0063.584] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml", lpFilePart=0x0) returned 0x82 [0063.584] GetLastError () returned 0x0 [0063.584] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml", dwFileAttributes=0x80) returned 1 [0063.585] GetLastError () returned 0x0 [0063.585] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe388, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml", lpFilePart=0x0) returned 0x82 [0063.585] GetLastError () returned 0x0 [0063.585] SetErrorMode (uMode=0x1) returned 0x0 [0063.585] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\masterdescriptor.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0063.585] GetLastError () returned 0x0 [0063.585] GetFileType (hFile=0x444) returned 0x1 [0063.585] SetErrorMode (uMode=0x0) returned 0x1 [0063.585] GetFileType (hFile=0x444) returned 0x1 [0063.585] GetFileSize (in: hFile=0x444, lpFileSizeHigh=0x8fe93c | out: lpFileSizeHigh=0x8fe93c*=0x0) returned 0x5b31 [0063.586] GetLastError () returned 0x0 [0063.586] ReadFile (in: hFile=0x444, lpBuffer=0x2aaf378, nNumberOfBytesToRead=0x5b31, lpNumberOfBytesRead=0x8fe8e4, lpOverlapped=0x0 | out: lpBuffer=0x2aaf378*, lpNumberOfBytesRead=0x8fe8e4*=0x5b31, lpOverlapped=0x0) returned 1 [0063.587] GetLastError () returned 0x0 [0063.587] CloseHandle (hObject=0x444) returned 1 [0063.587] GetLastError () returned 0x0 [0063.587] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0063.587] GetLastError () returned 0x0 [0063.588] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe88c | out: phKey=0x8fe88c*=0x9f6560) returned 1 [0063.588] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0063.588] GetLastError () returned 0x0 [0063.588] CryptSetKeyParam (hKey=0x9f6560, dwParam=0x4, pbData=0x2ab4f20*=0x1, dwFlags=0x0) returned 1 [0063.588] GetLastError () returned 0x0 [0063.588] CryptSetKeyParam (hKey=0x9f6560, dwParam=0x1, pbData=0x2ab4eec, dwFlags=0x0) returned 1 [0063.588] GetLastError () returned 0x0 [0063.588] CryptEncrypt (in: hKey=0x9f6560, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2ab4f30*, pdwDataLen=0x8fe944*=0x5b40, dwBufLen=0x5b40 | out: pbData=0x2ab4f30*, pdwDataLen=0x8fe944*=0x5b40) returned 1 [0063.588] GetLastError () returned 0x0 [0063.588] CryptEncrypt (in: hKey=0x9f6560, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2abaa90*, pdwDataLen=0x8fe94c*=0x0, dwBufLen=0x10 | out: pbData=0x2abaa90*, pdwDataLen=0x8fe94c*=0x10) returned 1 [0063.588] GetLastError () returned 0x0 [0063.588] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe390, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml", lpFilePart=0x0) returned 0x82 [0063.588] GetLastError () returned 0x0 [0063.588] SetErrorMode (uMode=0x1) returned 0x0 [0063.588] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\masterdescriptor.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0063.589] GetLastError () returned 0xb7 [0063.589] GetFileType (hFile=0x444) returned 0x1 [0063.590] SetErrorMode (uMode=0x0) returned 0x1 [0063.590] GetFileType (hFile=0x444) returned 0x1 [0063.590] WriteFile (in: hFile=0x444, lpBuffer=0x2ab4f30*, nNumberOfBytesToWrite=0x5b40, lpNumberOfBytesWritten=0x8fe8f0, lpOverlapped=0x0 | out: lpBuffer=0x2ab4f30*, lpNumberOfBytesWritten=0x8fe8f0*=0x5b40, lpOverlapped=0x0) returned 1 [0063.591] GetLastError () returned 0xb7 [0063.591] CloseHandle (hObject=0x444) returned 1 [0063.595] GetLastError () returned 0xb7 [0063.595] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml.Hr477yxJfm+N8NBYbP64Aw==.bwall", nBufferLength=0x105, lpBuffer=0x8fe390, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml.Hr477yxJfm+N8NBYbP64Aw==.bwall", lpFilePart=0x0) returned 0xa1 [0063.595] GetLastError () returned 0xb7 [0063.595] SetErrorMode (uMode=0x1) returned 0x0 [0063.595] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml.Hr477yxJfm+N8NBYbP64Aw==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\masterdescriptor.x-none.xml.hr477yxjfm+n8nbybp64aw==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0063.595] GetLastError () returned 0x0 [0063.595] GetFileType (hFile=0x444) returned 0x1 [0063.595] SetErrorMode (uMode=0x0) returned 0x1 [0063.595] GetFileType (hFile=0x444) returned 0x1 [0063.595] WriteFile (in: hFile=0x444, lpBuffer=0x2ab4f30*, nNumberOfBytesToWrite=0x5b40, lpNumberOfBytesWritten=0x8fe8f0, lpOverlapped=0x0 | out: lpBuffer=0x2ab4f30*, lpNumberOfBytesWritten=0x8fe8f0*=0x5b40, lpOverlapped=0x0) returned 1 [0063.597] GetLastError () returned 0x0 [0063.597] CloseHandle (hObject=0x444) returned 1 [0063.597] GetLastError () returned 0x0 [0063.597] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe4b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml", lpFilePart=0x0) returned 0x82 [0063.597] GetLastError () returned 0x0 [0063.597] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\masterdescriptor.x-none.xml")) returned 1 [0063.598] GetLastError () returned 0x0 [0063.603] GetProcessWindowStation () returned 0x13c [0063.603] GetActiveWindow () returned 0x7002e [0063.603] GetCurrentActCtx (in: lphActCtx=0x8fe8bc | out: lphActCtx=0x8fe8bc*=0x9f8cbc) returned 1 [0063.603] GetCurrentThreadId () returned 0x540 [0063.603] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c438a, lParam=0x0) returned 1 [0063.604] IsWindowVisible (hWnd=0x7002e) returned 0 [0063.604] IsWindowVisible (hWnd=0x4020e) returned 0 [0063.604] IsWindowVisible (hWnd=0x60044) returned 0 [0063.604] IsWindowVisible (hWnd=0x2021a) returned 0 [0063.604] IsWindowVisible (hWnd=0x8004a) returned 0 [0063.604] GetActiveWindow () returned 0x7002e [0063.604] GetFocus () returned 0x7002e [0063.604] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0063.605] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0063.605] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0063.606] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0063.606] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0063.606] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0063.610] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0063.617] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x25020c) returned 0x1 [0063.618] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe174) returned 0x0 [0063.618] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe174) returned 0x0 [0063.771] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0063.779] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdf7c) returned 0x0 [0063.779] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdf7c) returned 0x0 [0063.779] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x25020c) returned 0x1 [0063.781] SetFocus (hWnd=0x7002e) returned 0x25020c [0063.782] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0063.784] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0063.784] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0063.784] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0063.784] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x25020c, lParam=0x0) returned 0x0 [0063.788] IsWindow (hWnd=0x7002e) returned 1 [0063.788] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0063.789] IsWindow (hWnd=0x7002e) returned 1 [0063.789] SetFocus (hWnd=0x7002e) returned 0x7002e [0063.789] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0063.789] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0063.789] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0063.789] GetProcessWindowStation () returned 0x13c [0063.789] GetActiveWindow () returned 0x7002e [0063.789] GetCurrentActCtx (in: lphActCtx=0x8fe8bc | out: lphActCtx=0x8fe8bc*=0x9f8cbc) returned 1 [0063.789] GetCurrentThreadId () returned 0x540 [0063.790] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c42ca, lParam=0x0) returned 1 [0063.790] IsWindowVisible (hWnd=0x7002e) returned 0 [0063.790] IsWindowVisible (hWnd=0x4020e) returned 0 [0063.790] IsWindowVisible (hWnd=0x60044) returned 0 [0063.790] IsWindowVisible (hWnd=0x2021a) returned 0 [0063.790] IsWindowVisible (hWnd=0x8004a) returned 0 [0063.790] GetActiveWindow () returned 0x7002e [0063.790] GetFocus () returned 0x7002e [0063.790] MessageBoxW (hWnd=0x7002e, lpText="Md3j23JoihAh/MMHWP+78Q==", lpCaption="", uType=0x0) returned 1 [0063.791] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0063.791] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0063.792] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0063.793] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0063.793] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0063.793] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0063.802] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x26020c) returned 0x1 [0063.802] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe174) returned 0x0 [0063.803] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe174) returned 0x0 [0063.974] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0063.982] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdf7c) returned 0x0 [0063.982] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdf7c) returned 0x0 [0063.982] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x26020c) returned 0x1 [0063.986] SetFocus (hWnd=0x7002e) returned 0x26020c [0063.988] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0063.989] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0063.989] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0063.990] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0063.990] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x26020c, lParam=0x0) returned 0x0 [0063.994] IsWindow (hWnd=0x7002e) returned 1 [0063.994] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0063.994] IsWindow (hWnd=0x7002e) returned 1 [0063.994] SetFocus (hWnd=0x7002e) returned 0x7002e [0063.994] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0063.994] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0063.994] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0063.995] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml", nBufferLength=0x105, lpBuffer=0x8fe4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml", lpFilePart=0x0) returned 0x85 [0063.995] GetLastError () returned 0x0 [0063.995] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml", dwFileAttributes=0x80) returned 1 [0063.996] GetLastError () returned 0x0 [0063.996] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml", nBufferLength=0x105, lpBuffer=0x8fe388, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml", lpFilePart=0x0) returned 0x85 [0063.996] GetLastError () returned 0x0 [0063.996] SetErrorMode (uMode=0x1) returned 0x0 [0063.996] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.platform.x-none.man.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0063.997] GetLastError () returned 0x0 [0063.997] GetFileType (hFile=0x444) returned 0x1 [0063.997] SetErrorMode (uMode=0x0) returned 0x1 [0063.997] GetFileType (hFile=0x444) returned 0x1 [0063.997] GetFileSize (in: hFile=0x444, lpFileSizeHigh=0x8fe93c | out: lpFileSizeHigh=0x8fe93c*=0x0) returned 0x7e0a5c [0063.997] GetLastError () returned 0x0 [0064.021] ReadFile (in: hFile=0x444, lpBuffer=0x8341008, nNumberOfBytesToRead=0x7e0a5c, lpNumberOfBytesRead=0x8fe8e4, lpOverlapped=0x0 | out: lpBuffer=0x8341008*, lpNumberOfBytesRead=0x8fe8e4*=0x7e0a5c, lpOverlapped=0x0) returned 1 [0064.329] GetLastError () returned 0x0 [0064.329] CloseHandle (hObject=0x444) returned 1 [0064.329] GetLastError () returned 0x0 [0064.330] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0064.330] GetLastError () returned 0x0 [0064.330] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe88c | out: phKey=0x8fe88c*=0x9f65a0) returned 1 [0064.330] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0064.330] GetLastError () returned 0x0 [0064.330] CryptSetKeyParam (hKey=0x9f65a0, dwParam=0x4, pbData=0x2ac44d8*=0x1, dwFlags=0x0) returned 1 [0064.330] GetLastError () returned 0x0 [0064.330] CryptSetKeyParam (hKey=0x9f65a0, dwParam=0x1, pbData=0x2ac44a4, dwFlags=0x0) returned 1 [0064.330] GetLastError () returned 0x0 [0064.586] CryptEncrypt (in: hKey=0x9f65a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a18010*, pdwDataLen=0x8fe944*=0x7e0a60, dwBufLen=0x7e0a60 | out: pbData=0x3a18010*, pdwDataLen=0x8fe944*=0x7e0a60) returned 1 [0064.595] GetLastError () returned 0x0 [0064.595] CryptEncrypt (in: hKey=0x9f65a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2a368d4*, pdwDataLen=0x8fe94c*=0x0, dwBufLen=0x10 | out: pbData=0x2a368d4*, pdwDataLen=0x8fe94c*=0x10) returned 1 [0064.595] GetLastError () returned 0x0 [0064.595] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml", nBufferLength=0x105, lpBuffer=0x8fe390, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml", lpFilePart=0x0) returned 0x85 [0064.595] GetLastError () returned 0x0 [0064.595] SetErrorMode (uMode=0x1) returned 0x0 [0064.596] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.platform.x-none.man.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0064.604] GetLastError () returned 0xb7 [0064.604] GetFileType (hFile=0x444) returned 0x1 [0064.604] SetErrorMode (uMode=0x0) returned 0x1 [0064.604] GetFileType (hFile=0x444) returned 0x1 [0064.604] WriteFile (in: hFile=0x444, lpBuffer=0x3a18010*, nNumberOfBytesToWrite=0x7e0a60, lpNumberOfBytesWritten=0x8fe8f0, lpOverlapped=0x0 | out: lpBuffer=0x3a18010*, lpNumberOfBytesWritten=0x8fe8f0*=0x7e0a60, lpOverlapped=0x0) returned 1 [0064.818] GetLastError () returned 0xb7 [0064.818] CloseHandle (hObject=0x444) returned 1 [0065.108] GetLastError () returned 0xb7 [0065.109] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml.Md3j23JoihAh#MMHWP+78Q==.bwall", nBufferLength=0x105, lpBuffer=0x8fe390, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml.Md3j23JoihAh#MMHWP+78Q==.bwall", lpFilePart=0x0) returned 0xa4 [0065.109] GetLastError () returned 0xb7 [0065.109] SetErrorMode (uMode=0x1) returned 0x0 [0065.109] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml.Md3j23JoihAh#MMHWP+78Q==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.platform.x-none.man.xml.md3j23joihah#mmhwp+78q==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0065.111] GetLastError () returned 0x0 [0065.111] GetFileType (hFile=0x444) returned 0x1 [0065.112] SetErrorMode (uMode=0x0) returned 0x1 [0065.112] GetFileType (hFile=0x444) returned 0x1 [0065.112] WriteFile (in: hFile=0x444, lpBuffer=0x3a18010*, nNumberOfBytesToWrite=0x7e0a60, lpNumberOfBytesWritten=0x8fe8f0, lpOverlapped=0x0 | out: lpBuffer=0x3a18010*, lpNumberOfBytesWritten=0x8fe8f0*=0x7e0a60, lpOverlapped=0x0) returned 1 [0065.274] GetLastError () returned 0x0 [0065.274] CloseHandle (hObject=0x444) returned 1 [0065.617] GetLastError () returned 0x0 [0065.617] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml", nBufferLength=0x105, lpBuffer=0x8fe4b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml", lpFilePart=0x0) returned 0x85 [0065.617] GetLastError () returned 0x0 [0065.617] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.platform.x-none.man.xml")) returned 1 [0065.626] GetLastError () returned 0x0 [0065.632] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16", nBufferLength=0x105, lpBuffer=0x8fe46c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16", lpFilePart=0x0) returned 0x66 [0065.632] GetLastError () returned 0x0 [0065.632] SetErrorMode (uMode=0x1) returned 0x0 [0065.632] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd67b6ab3, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f5ba0 [0065.632] GetLastError () returned 0x0 [0065.632] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd67b6ab3, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.632] GetLastError () returned 0x0 [0065.632] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5465891, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xd5465891, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xd5465891, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x5b40, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.x-none.xml.Hr477yxJfm+N8NBYbP64Aw==.bwall", cAlternateFileName="MASTER~1.BWA")) returned 1 [0065.633] GetLastError () returned 0x0 [0065.633] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19bf9d35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19bf9d35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6aa2800, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s320.hash", cAlternateFileName="S320~1.HAS")) returned 1 [0065.633] GetLastError () returned 0x0 [0065.633] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd62d9b79, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xd62d9b79, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xd67b362d, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x7e0a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.Platform.x-none.man.xml.Md3j23JoihAh#MMHWP+78Q==.bwall", cAlternateFileName="STREAM~1.BWA")) returned 1 [0065.633] GetLastError () returned 0x0 [0065.634] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19fffcc2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19fffcc2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x316a100, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x80, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.x-none.hash", cAlternateFileName="STREAM~1.HAS")) returned 1 [0065.634] GetLastError () returned 0x0 [0065.634] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19fffcc2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19fffcc2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0065.634] GetLastError () returned 0x0 [0065.634] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19fffcc2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19fffcc2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0065.635] GetLastError () returned 0x12 [0065.635] FindClose (in: hFindFile=0x9f5ba0 | out: hFindFile=0x9f5ba0) returned 1 [0065.635] SetErrorMode (uMode=0x0) returned 0x1 [0065.635] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe3a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x79 [0065.635] GetLastError () returned 0x12 [0065.635] SetErrorMode (uMode=0x1) returned 0x0 [0065.636] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x444 [0065.637] GetLastError () returned 0x0 [0065.637] GetFileType (hFile=0x444) returned 0x1 [0065.637] SetErrorMode (uMode=0x0) returned 0x1 [0065.637] GetFileType (hFile=0x444) returned 0x1 [0065.637] WriteFile (in: hFile=0x444, lpBuffer=0x2a493c0*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe900, lpOverlapped=0x0 | out: lpBuffer=0x2a493c0*, lpNumberOfBytesWritten=0x8fe900*=0xbcb, lpOverlapped=0x0) returned 1 [0065.638] GetLastError () returned 0x0 [0065.638] CloseHandle (hObject=0x444) returned 1 [0065.638] GetLastError () returned 0x0 [0065.639] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe3dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x6f [0065.639] GetLastError () returned 0x0 [0065.639] SetErrorMode (uMode=0x1) returned 0x0 [0065.639] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x444 [0065.639] GetLastError () returned 0x0 [0065.639] GetFileType (hFile=0x444) returned 0x1 [0065.639] SetErrorMode (uMode=0x0) returned 0x1 [0065.639] GetFileType (hFile=0x444) returned 0x1 [0065.640] WriteFile (in: hFile=0x444, lpBuffer=0x2a50168*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe934, lpOverlapped=0x0 | out: lpBuffer=0x2a50168*, lpNumberOfBytesWritten=0x8fe934*=0xbcb, lpOverlapped=0x0) returned 1 [0065.640] GetLastError () returned 0x0 [0065.640] CloseHandle (hObject=0x444) returned 1 [0065.641] GetLastError () returned 0x0 [0065.641] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F", lpFilePart=0x0) returned 0x5c [0065.641] GetLastError () returned 0x0 [0065.641] SetErrorMode (uMode=0x1) returned 0x0 [0065.641] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f5860 [0065.642] GetLastError () returned 0x0 [0065.643] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.643] GetLastError () returned 0x0 [0065.643] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110186f1, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1 [0065.643] GetLastError () returned 0x0 [0065.643] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0065.643] GetLastError () returned 0x0 [0065.643] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0065.643] GetLastError () returned 0x12 [0065.643] FindClose (in: hFindFile=0x9f5860 | out: hFindFile=0x9f5860) returned 1 [0065.644] SetErrorMode (uMode=0x0) returned 0x1 [0065.644] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F", lpFilePart=0x0) returned 0x5c [0065.644] GetLastError () returned 0x12 [0065.644] SetErrorMode (uMode=0x1) returned 0x0 [0065.644] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f5860 [0065.644] GetLastError () returned 0x12 [0065.644] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.644] GetLastError () returned 0x12 [0065.644] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110186f1, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1 [0065.644] GetLastError () returned 0x12 [0065.645] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0065.645] GetLastError () returned 0x12 [0065.645] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0065.645] GetLastError () returned 0x12 [0065.645] FindClose (in: hFindFile=0x9f5860 | out: hFindFile=0x9f5860) returned 1 [0065.645] SetErrorMode (uMode=0x0) returned 0x1 [0065.645] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16", nBufferLength=0x105, lpBuffer=0x8fe46c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16", lpFilePart=0x0) returned 0x65 [0065.645] GetLastError () returned 0x12 [0065.645] SetErrorMode (uMode=0x1) returned 0x0 [0065.645] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110186f1, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f5860 [0065.647] GetLastError () returned 0x12 [0065.647] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110186f1, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.647] GetLastError () returned 0x12 [0065.648] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x113f8423, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x113f8423, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0065.648] GetLastError () returned 0x12 [0065.648] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x113f8423, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x113f8423, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0065.648] GetLastError () returned 0x12 [0065.648] FindClose (in: hFindFile=0x9f5860 | out: hFindFile=0x9f5860) returned 1 [0065.649] SetErrorMode (uMode=0x0) returned 0x1 [0065.649] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16", nBufferLength=0x105, lpBuffer=0x8fe46c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16", lpFilePart=0x0) returned 0x65 [0065.649] GetLastError () returned 0x12 [0065.649] SetErrorMode (uMode=0x1) returned 0x0 [0065.649] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110186f1, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f5860 [0065.650] GetLastError () returned 0x12 [0065.650] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110186f1, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.650] GetLastError () returned 0x12 [0065.651] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x113f8423, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x113f8423, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0065.651] GetLastError () returned 0x12 [0065.651] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x113f8423, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x113f8423, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0065.651] GetLastError () returned 0x12 [0065.651] FindClose (in: hFindFile=0x9f5860 | out: hFindFile=0x9f5860) returned 1 [0065.652] SetErrorMode (uMode=0x0) returned 0x1 [0065.652] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe3a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x78 [0065.652] GetLastError () returned 0x12 [0065.652] SetErrorMode (uMode=0x1) returned 0x0 [0065.652] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\en-us.16\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x444 [0065.653] GetLastError () returned 0x0 [0065.653] GetFileType (hFile=0x444) returned 0x1 [0065.653] SetErrorMode (uMode=0x0) returned 0x1 [0065.653] GetFileType (hFile=0x444) returned 0x1 [0065.654] WriteFile (in: hFile=0x444, lpBuffer=0x2a5dc90*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe900, lpOverlapped=0x0 | out: lpBuffer=0x2a5dc90*, lpNumberOfBytesWritten=0x8fe900*=0xbcb, lpOverlapped=0x0) returned 1 [0065.654] GetLastError () returned 0x0 [0065.654] CloseHandle (hObject=0x444) returned 1 [0065.655] GetLastError () returned 0x0 [0065.655] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16", nBufferLength=0x105, lpBuffer=0x8fe46c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16", lpFilePart=0x0) returned 0x66 [0065.655] GetLastError () returned 0x0 [0065.655] SetErrorMode (uMode=0x1) returned 0x0 [0065.655] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f5ba0 [0065.656] GetLastError () returned 0x0 [0065.656] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.656] GetLastError () returned 0x0 [0065.657] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x10ff2492, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x10ff2492, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0065.657] GetLastError () returned 0x0 [0065.657] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x10ff2492, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x10ff2492, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0065.657] GetLastError () returned 0x12 [0065.657] FindClose (in: hFindFile=0x9f5ba0 | out: hFindFile=0x9f5ba0) returned 1 [0065.658] SetErrorMode (uMode=0x0) returned 0x1 [0065.658] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16", nBufferLength=0x105, lpBuffer=0x8fe46c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16", lpFilePart=0x0) returned 0x66 [0065.658] GetLastError () returned 0x12 [0065.658] SetErrorMode (uMode=0x1) returned 0x0 [0065.658] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f5860 [0065.659] GetLastError () returned 0x12 [0065.659] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.659] GetLastError () returned 0x12 [0065.659] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x10ff2492, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x10ff2492, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0065.659] GetLastError () returned 0x12 [0065.659] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x10ff2492, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x10ff2492, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0065.660] GetLastError () returned 0x12 [0065.660] FindClose (in: hFindFile=0x9f5860 | out: hFindFile=0x9f5860) returned 1 [0065.660] SetErrorMode (uMode=0x0) returned 0x1 [0065.661] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe3a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x79 [0065.661] GetLastError () returned 0x12 [0065.661] SetErrorMode (uMode=0x1) returned 0x0 [0065.661] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\x-none.16\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x444 [0065.662] GetLastError () returned 0x0 [0065.662] GetFileType (hFile=0x444) returned 0x1 [0065.662] SetErrorMode (uMode=0x0) returned 0x1 [0065.662] GetFileType (hFile=0x444) returned 0x1 [0065.662] WriteFile (in: hFile=0x444, lpBuffer=0x2a6a3a0*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe900, lpOverlapped=0x0 | out: lpBuffer=0x2a6a3a0*, lpNumberOfBytesWritten=0x8fe900*=0xbcb, lpOverlapped=0x0) returned 1 [0065.663] GetLastError () returned 0x0 [0065.663] CloseHandle (hObject=0x444) returned 1 [0065.663] GetLastError () returned 0x0 [0065.664] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe3dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x6f [0065.664] GetLastError () returned 0x0 [0065.664] SetErrorMode (uMode=0x1) returned 0x0 [0065.664] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x444 [0065.665] GetLastError () returned 0x0 [0065.665] GetFileType (hFile=0x444) returned 0x1 [0065.665] SetErrorMode (uMode=0x0) returned 0x1 [0065.665] GetFileType (hFile=0x444) returned 0x1 [0065.665] WriteFile (in: hFile=0x444, lpBuffer=0x2a71148*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe934, lpOverlapped=0x0 | out: lpBuffer=0x2a71148*, lpNumberOfBytesWritten=0x8fe934*=0xbcb, lpOverlapped=0x0) returned 1 [0065.666] GetLastError () returned 0x0 [0065.666] CloseHandle (hObject=0x444) returned 1 [0065.666] GetLastError () returned 0x0 [0065.667] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x4a [0065.667] GetLastError () returned 0x0 [0065.667] SetErrorMode (uMode=0x1) returned 0x0 [0065.667] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x444 [0065.667] GetLastError () returned 0x0 [0065.667] GetFileType (hFile=0x444) returned 0x1 [0065.667] SetErrorMode (uMode=0x0) returned 0x1 [0065.667] GetFileType (hFile=0x444) returned 0x1 [0065.668] WriteFile (in: hFile=0x444, lpBuffer=0x2a77e5c*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe968, lpOverlapped=0x0 | out: lpBuffer=0x2a77e5c*, lpNumberOfBytesWritten=0x8fe968*=0xbcb, lpOverlapped=0x0) returned 1 [0065.668] GetLastError () returned 0x0 [0065.668] CloseHandle (hObject=0x444) returned 1 [0065.669] GetLastError () returned 0x0 [0065.669] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\UserData", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\UserData", lpFilePart=0x0) returned 0x30 [0065.669] GetLastError () returned 0x0 [0065.669] SetErrorMode (uMode=0x1) returned 0x0 [0065.669] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\UserData\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f5ba0 [0065.669] GetLastError () returned 0x0 [0065.669] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.669] GetLastError () returned 0x0 [0065.670] FindNextFileW (in: hFindFile=0x9f5ba0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0065.670] GetLastError () returned 0x12 [0065.670] FindClose (in: hFindFile=0x9f5ba0 | out: hFindFile=0x9f5ba0) returned 1 [0065.670] SetErrorMode (uMode=0x0) returned 0x1 [0065.670] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\UserData", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\UserData", lpFilePart=0x0) returned 0x30 [0065.670] GetLastError () returned 0x12 [0065.670] SetErrorMode (uMode=0x1) returned 0x0 [0065.670] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\UserData\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f5860 [0065.670] GetLastError () returned 0x12 [0065.670] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.670] GetLastError () returned 0x12 [0065.671] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0065.671] GetLastError () returned 0x12 [0065.671] FindClose (in: hFindFile=0x9f5860 | out: hFindFile=0x9f5860) returned 1 [0065.671] SetErrorMode (uMode=0x0) returned 0x1 [0065.671] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\UserData\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\UserData\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x43 [0065.671] GetLastError () returned 0x12 [0065.671] SetErrorMode (uMode=0x1) returned 0x0 [0065.671] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\UserData\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\userdata\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x444 [0065.672] GetLastError () returned 0x0 [0065.672] GetFileType (hFile=0x444) returned 0x1 [0065.672] SetErrorMode (uMode=0x0) returned 0x1 [0065.672] GetFileType (hFile=0x444) returned 0x1 [0065.672] WriteFile (in: hFile=0x444, lpBuffer=0x2a7f6bc*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe968, lpOverlapped=0x0 | out: lpBuffer=0x2a7f6bc*, lpNumberOfBytesWritten=0x8fe968*=0xbcb, lpOverlapped=0x0) returned 1 [0065.673] GetLastError () returned 0x0 [0065.673] CloseHandle (hObject=0x444) returned 1 [0065.673] GetLastError () returned 0x0 [0065.673] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpFilePart=0x0) returned 0x4e [0065.673] GetLastError () returned 0x0 [0065.673] SetErrorMode (uMode=0x1) returned 0x0 [0065.673] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f5860 [0065.699] GetLastError () returned 0x0 [0065.699] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.700] GetLastError () returned 0x0 [0065.700] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437adb83, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x437adb83, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x247ecc35, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x44e23, dwReserved0=0x0, dwReserved1=0x0, cFileName="AirSpace.Etw.man", cAlternateFileName="AIRSPA~1.MAN")) returned 1 [0065.700] GetLastError () returned 0x0 [0065.700] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2686ce0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x91f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Access.Access.x-none.msi.16.x-none.xml", cAlternateFileName="C25A45~1.XML")) returned 1 [0065.700] GetLastError () returned 0x0 [0065.700] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd356d87a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xe71c, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.accessmui.msi.16.en-us.xml", cAlternateFileName="C222C2~1.XML")) returned 1 [0065.700] GetLastError () returned 0x0 [0065.701] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd31d9ff6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.accessmuiset.msi.16.en-us.xml", cAlternateFileName="C2FB2E~1.XML")) returned 1 [0065.701] GetLastError () returned 0x0 [0065.701] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed6f62ed, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed6f62ed, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd26f9444, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3f14, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", cAlternateFileName="C210C4~1.XML")) returned 1 [0065.701] GetLastError () returned 0x0 [0065.701] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed6f62ed, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed6f62ed, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd31415cd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x265a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.dcfmui.msi.16.en-us.xml", cAlternateFileName="C206B0~1.XML")) returned 1 [0065.701] GetLastError () returned 0x0 [0065.701] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed611426, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed611426, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd252f7b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x39d9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", cAlternateFileName="C21578~1.XML")) returned 1 [0065.701] GetLastError () returned 0x0 [0065.701] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed5c4f9a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed5c4f9a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd330b2e9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.excelmui.msi.16.en-us.xml", cAlternateFileName="C2D2CD~1.XML")) returned 1 [0065.701] GetLastError () returned 0x0 [0065.702] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd23fe538, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8f8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", cAlternateFileName="C233DB~1.XML")) returned 1 [0065.702] GetLastError () returned 0x0 [0065.702] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3298bbd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x180e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.groovemui.msi.16.en-us.xml", cAlternateFileName="C26024~1.XML")) returned 1 [0065.702] GetLastError () returned 0x0 [0065.702] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd257bc65, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1979c, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", cAlternateFileName="C25956~1.XML")) returned 1 [0065.702] GetLastError () returned 0x0 [0065.702] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed578aca, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed578aca, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd32bedda, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5b94, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.lyncmui.msi.16.en-us.xml", cAlternateFileName="C2FCD6~1.XML")) returned 1 [0065.702] GetLastError () returned 0x0 [0065.702] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed5063b1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed5063b1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3593a88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6b4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.office32mui.msi.16.en-us.xml", cAlternateFileName="C2BADD~1.XML")) returned 1 [0065.702] GetLastError () returned 0x0 [0065.703] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed3d50b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed3d50b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2cc8f5f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4f3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.office32ww.msi.16.x-none.xml", cAlternateFileName="C2EBFE~1.XML")) returned 1 [0065.703] GetLastError () returned 0x0 [0065.703] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed31650e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed31650e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd36c4db5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x19870, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.officemui.msi.16.en-us.xml", cAlternateFileName="C29059~1.XML")) returned 1 [0065.703] GetLastError () returned 0x0 [0065.703] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2f02a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2f02a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd38424c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.officemuiset.msi.16.en-us.xml", cAlternateFileName="C2467F~1.XML")) returned 1 [0065.703] GetLastError () returned 0x0 [0065.703] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2f02a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2f02a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd295b9b9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17b3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", cAlternateFileName="C21839~1.XML")) returned 1 [0065.703] GetLastError () returned 0x0 [0065.703] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2ca0b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2ca0b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd375d6d3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4a4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.onenotemui.msi.16.en-us.xml", cAlternateFileName="C24C3D~1.XML")) returned 1 [0065.703] GetLastError () returned 0x0 [0065.703] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a3e81, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2a3e81, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd29a7ddb, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", cAlternateFileName="C24EFF~1.XML")) returned 1 [0065.703] GetLastError () returned 0x0 [0065.703] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a3e81, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2a3e81, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3678904, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2b28, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.osmmui.msi.16.en-us.xml", cAlternateFileName="C25F09~1.XML")) returned 1 [0065.703] GetLastError () returned 0x0 [0065.704] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd28c2fa3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x906, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", cAlternateFileName="C22C6F~1.XML")) returned 1 [0065.704] GetLastError () returned 0x0 [0065.704] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd362c40f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2b8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.osmuxmui.msi.16.en-us.xml", cAlternateFileName="C21C45~1.XML")) returned 1 [0065.704] GetLastError () returned 0x0 [0065.704] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd276bb03, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17194, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", cAlternateFileName="C29151~1.XML")) returned 1 [0065.704] GetLastError () returned 0x0 [0065.705] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed20b499, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed20b499, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3783951, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17984, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.outlookmui.msi.16.en-us.xml", cAlternateFileName="C2C4E2~1.XML")) returned 1 [0065.705] GetLastError () returned 0x0 [0065.705] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed1e5243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed1e5243, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd27de170, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xafddc, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", cAlternateFileName="C280EB~1.XML")) returned 1 [0065.705] GetLastError () returned 0x0 [0065.705] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed12666a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed12666a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd290f4ec, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x195a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", cAlternateFileName="C222CA~1.XML")) returned 1 [0065.705] GetLastError () returned 0x0 [0065.705] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed0da264, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed0da264, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd35dffce, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x689e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.powerpointmui.msi.16.en-us.xml", cAlternateFileName="C27FF4~1.XML")) returned 1 [0065.705] GetLastError () returned 0x0 [0065.705] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b87bb60, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b1a0d3d, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x7446, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Project.Project.x-none.msi.16.x-none.xml", cAlternateFileName="C2E87B~1.XML")) returned 1 [0065.705] GetLastError () returned 0x0 [0065.705] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b87bb60, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b2d20ad, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x809e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.projectmui.msi.16.en-us.xml", cAlternateFileName="C26005~1.XML")) returned 1 [0065.705] GetLastError () returned 0x0 [0065.706] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed08dd97, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed08dd97, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd397382c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x63ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Proof.Culture.msi.16.en-us.xml", cAlternateFileName="C2B3EB~1.XML")) returned 1 [0065.706] GetLastError () returned 0x0 [0065.706] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed08dd97, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed08dd97, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd37a9bb2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5fee, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Proof.Culture.msi.16.es-es.xml", cAlternateFileName="C23127~1.XML")) returned 1 [0065.706] GetLastError () returned 0x0 [0065.706] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed067a9a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed067a9a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3999a72, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5fee, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Proof.Culture.msi.16.fr-fr.xml", cAlternateFileName="C2BAB3~1.XML")) returned 1 [0065.706] GetLastError () returned 0x0 [0065.706] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd37f6035, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.proofing.msi.16.en-us.xml", cAlternateFileName="C24618~1.XML")) returned 1 [0065.706] GetLastError () returned 0x0 [0065.706] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2b97d2d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", cAlternateFileName="C2C6D1~1.XML")) returned 1 [0065.706] GetLastError () returned 0x0 [0065.706] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd37374c5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.publishermui.msi.16.en-us.xml", cAlternateFileName="C2RMAN~4.XML")) returned 1 [0065.706] GetLastError () returned 0x0 [0065.707] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed01b5ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed01b5ef, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd29ce0e8, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb27ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.shared.Office.x-none.msi.16.x-none.xml", cAlternateFileName="C2RMAN~3.XML")) returned 1 [0065.707] GetLastError () returned 0x0 [0065.707] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a705a3, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a705a3, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x11cbd0e, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x2aafe, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", cAlternateFileName="C2668D~1.XML")) returned 1 [0065.707] GetLastError () returned 0x0 [0065.707] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a4a3b4, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a4a3b4, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1218203, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xf0cb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.visiomui.msi.16.en-us.xml", cAlternateFileName="C2A712~1.XML")) returned 1 [0065.707] GetLastError () returned 0x0 [0065.707] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf5ca1c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xecf5ca1c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2dd401b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1536e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Word.Word.x-none.msi.16.x-none.xml", cAlternateFileName="C2RMAN~2.XML")) returned 1 [0065.707] GetLastError () returned 0x0 [0065.707] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xecf3682d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3a7e818, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x130fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.wordmui.msi.16.en-us.xml", cAlternateFileName="C2RMAN~1.XML")) returned 1 [0065.707] GetLastError () returned 0x0 [0065.707] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x49bee514, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xd2dfa2a2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12c470, dwReserved0=0x0, dwReserved1=0x0, cFileName="integrator.exe", cAlternateFileName="INTEGR~1.EXE")) returned 1 [0065.707] GetLastError () returned 0x0 [0065.707] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f3481a2, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x3f3481a2, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf427d4ce, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", cAlternateFileName="MICROS~2.XML")) returned 1 [0065.708] GetLastError () returned 0x0 [0065.708] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f0e5bdc, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x3f0e5bdc, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf40d9aa3, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0xca6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", cAlternateFileName="MICROS~1.XML")) returned 1 [0065.708] GetLastError () returned 0x0 [0065.708] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x433f4072, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x433f4072, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x1bd7df5e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1b826, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoutilstat.etw.man", cAlternateFileName="MSOUTI~1.MAN")) returned 1 [0065.708] GetLastError () returned 0x0 [0065.708] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42b4f7c0, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x42b4f7c0, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x244f1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9bddd, dwReserved0=0x0, dwReserved1=0x0, cFileName="wordEtw.man", cAlternateFileName="")) returned 1 [0065.708] GetLastError () returned 0x0 [0065.708] FindNextFileW (in: hFindFile=0x9f5860, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42b4f7c0, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x42b4f7c0, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x244f1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9bddd, dwReserved0=0x0, dwReserved1=0x0, cFileName="wordEtw.man", cAlternateFileName="")) returned 0 [0065.708] GetLastError () returned 0x12 [0065.708] FindClose (in: hFindFile=0x9f5860 | out: hFindFile=0x9f5860) returned 1 [0065.709] SetErrorMode (uMode=0x0) returned 0x1 [0065.710] GetProcessWindowStation () returned 0x13c [0065.710] GetActiveWindow () returned 0x7002e [0065.710] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0065.710] GetCurrentThreadId () returned 0x540 [0065.711] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c435a, lParam=0x0) returned 1 [0065.711] IsWindowVisible (hWnd=0x7002e) returned 0 [0065.711] IsWindowVisible (hWnd=0x4020e) returned 0 [0065.711] IsWindowVisible (hWnd=0x60044) returned 0 [0065.711] IsWindowVisible (hWnd=0x2021a) returned 0 [0065.712] IsWindowVisible (hWnd=0x8004a) returned 0 [0065.712] GetActiveWindow () returned 0x7002e [0065.712] GetFocus () returned 0x7002e [0065.712] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0065.714] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0065.715] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0065.716] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0065.716] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0065.716] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0065.717] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0065.725] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x27020c) returned 0x1 [0065.726] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0065.726] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0065.908] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0065.919] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0065.919] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0065.919] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x27020c) returned 0x1 [0065.920] SetFocus (hWnd=0x7002e) returned 0x27020c [0065.922] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0065.923] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0065.923] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0065.924] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0065.924] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x27020c, lParam=0x0) returned 0x0 [0065.928] IsWindow (hWnd=0x7002e) returned 1 [0065.928] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0065.928] IsWindow (hWnd=0x7002e) returned 1 [0065.929] SetFocus (hWnd=0x7002e) returned 0x7002e [0065.929] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0065.929] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0065.929] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0065.929] GetProcessWindowStation () returned 0x13c [0065.929] GetActiveWindow () returned 0x7002e [0065.929] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0065.929] GetCurrentThreadId () returned 0x540 [0065.930] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c450a, lParam=0x0) returned 1 [0065.930] IsWindowVisible (hWnd=0x7002e) returned 0 [0065.930] IsWindowVisible (hWnd=0x4020e) returned 0 [0065.932] IsWindowVisible (hWnd=0x60044) returned 0 [0065.932] IsWindowVisible (hWnd=0x2021a) returned 0 [0065.932] IsWindowVisible (hWnd=0x8004a) returned 0 [0065.932] GetActiveWindow () returned 0x7002e [0065.932] GetFocus () returned 0x7002e [0065.933] MessageBoxW (hWnd=0x7002e, lpText="sO8000IXLYHiLxG7GDBDVw==", lpCaption="", uType=0x0) returned 1 [0065.933] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0065.934] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0065.934] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0065.935] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0065.935] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0065.935] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0065.942] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x28020c) returned 0x1 [0065.943] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0065.943] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0066.099] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0066.106] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0066.106] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0066.107] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x28020c) returned 0x1 [0066.108] SetFocus (hWnd=0x7002e) returned 0x28020c [0066.110] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0066.111] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0066.111] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0066.111] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0066.111] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x28020c, lParam=0x0) returned 0x0 [0066.116] IsWindow (hWnd=0x7002e) returned 1 [0066.116] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0066.116] IsWindow (hWnd=0x7002e) returned 1 [0066.116] SetFocus (hWnd=0x7002e) returned 0x7002e [0066.116] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0066.116] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0066.116] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0066.116] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x81 [0066.116] GetLastError () returned 0x0 [0066.116] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", dwFileAttributes=0x80) returned 1 [0066.121] GetLastError () returned 0x0 [0066.121] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x81 [0066.121] GetLastError () returned 0x0 [0066.121] SetErrorMode (uMode=0x1) returned 0x0 [0066.121] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0066.121] GetLastError () returned 0x0 [0066.121] GetFileType (hFile=0x444) returned 0x1 [0066.121] SetErrorMode (uMode=0x0) returned 0x1 [0066.122] GetFileType (hFile=0x444) returned 0x1 [0066.122] GetFileSize (in: hFile=0x444, lpFileSizeHigh=0x8fe9a4 | out: lpFileSizeHigh=0x8fe9a4*=0x0) returned 0x91f0 [0066.122] GetLastError () returned 0x0 [0066.122] ReadFile (in: hFile=0x444, lpBuffer=0x2a8c118, nNumberOfBytesToRead=0x91f0, lpNumberOfBytesRead=0x8fe94c, lpOverlapped=0x0 | out: lpBuffer=0x2a8c118*, lpNumberOfBytesRead=0x8fe94c*=0x91f0, lpOverlapped=0x0) returned 1 [0066.124] GetLastError () returned 0x0 [0066.124] CloseHandle (hObject=0x444) returned 1 [0066.124] GetLastError () returned 0x0 [0066.124] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0066.124] GetLastError () returned 0x0 [0066.124] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8f4 | out: phKey=0x8fe8f4*=0x9f5860) returned 1 [0066.124] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0066.124] GetLastError () returned 0x0 [0066.124] CryptSetKeyParam (hKey=0x9f5860, dwParam=0x4, pbData=0x2a9537c*=0x1, dwFlags=0x0) returned 1 [0066.124] GetLastError () returned 0x0 [0066.124] CryptSetKeyParam (hKey=0x9f5860, dwParam=0x1, pbData=0x2a95348, dwFlags=0x0) returned 1 [0066.124] GetLastError () returned 0x0 [0066.125] CryptEncrypt (in: hKey=0x9f5860, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2a9538c*, pdwDataLen=0x8fe9ac*=0x9200, dwBufLen=0x9200 | out: pbData=0x2a9538c*, pdwDataLen=0x8fe9ac*=0x9200) returned 1 [0066.125] GetLastError () returned 0x0 [0066.125] CryptEncrypt (in: hKey=0x9f5860, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2a9e5ac*, pdwDataLen=0x8fe9b4*=0x0, dwBufLen=0x10 | out: pbData=0x2a9e5ac*, pdwDataLen=0x8fe9b4*=0x10) returned 1 [0066.125] GetLastError () returned 0x0 [0066.125] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x81 [0066.125] GetLastError () returned 0x0 [0066.125] SetErrorMode (uMode=0x1) returned 0x0 [0066.125] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0066.126] GetLastError () returned 0xb7 [0066.126] GetFileType (hFile=0x444) returned 0x1 [0066.126] SetErrorMode (uMode=0x0) returned 0x1 [0066.126] GetFileType (hFile=0x444) returned 0x1 [0066.126] WriteFile (in: hFile=0x444, lpBuffer=0x2a9538c*, nNumberOfBytesToWrite=0x9200, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2a9538c*, lpNumberOfBytesWritten=0x8fe958*=0x9200, lpOverlapped=0x0) returned 1 [0066.128] GetLastError () returned 0xb7 [0066.128] CloseHandle (hObject=0x444) returned 1 [0066.130] GetLastError () returned 0xb7 [0066.130] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml.sO8000IXLYHiLxG7GDBDVw==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml.sO8000IXLYHiLxG7GDBDVw==.bwall", lpFilePart=0x0) returned 0xa0 [0066.130] GetLastError () returned 0xb7 [0066.130] SetErrorMode (uMode=0x1) returned 0x0 [0066.130] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml.sO8000IXLYHiLxG7GDBDVw==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml.so8000ixlyhilxg7gdbdvw==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0066.130] GetLastError () returned 0x0 [0066.130] GetFileType (hFile=0x444) returned 0x1 [0066.130] SetErrorMode (uMode=0x0) returned 0x1 [0066.130] GetFileType (hFile=0x444) returned 0x1 [0066.131] WriteFile (in: hFile=0x444, lpBuffer=0x2a9538c*, nNumberOfBytesToWrite=0x9200, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2a9538c*, lpNumberOfBytesWritten=0x8fe958*=0x9200, lpOverlapped=0x0) returned 1 [0066.132] GetLastError () returned 0x0 [0066.132] CloseHandle (hObject=0x444) returned 1 [0066.133] GetLastError () returned 0x0 [0066.135] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x81 [0066.135] GetLastError () returned 0x0 [0066.135] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml")) returned 1 [0066.136] GetLastError () returned 0x0 [0066.141] GetProcessWindowStation () returned 0x13c [0066.141] GetActiveWindow () returned 0x7002e [0066.141] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0066.141] GetCurrentThreadId () returned 0x540 [0066.141] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c456a, lParam=0x0) returned 1 [0066.141] IsWindowVisible (hWnd=0x7002e) returned 0 [0066.141] IsWindowVisible (hWnd=0x4020e) returned 0 [0066.141] IsWindowVisible (hWnd=0x60044) returned 0 [0066.141] IsWindowVisible (hWnd=0x2021a) returned 0 [0066.142] IsWindowVisible (hWnd=0x8004a) returned 0 [0066.142] GetActiveWindow () returned 0x7002e [0066.142] GetFocus () returned 0x7002e [0066.142] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0066.143] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0066.143] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0066.144] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0066.144] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0066.144] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0066.145] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0066.152] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x29020c) returned 0x1 [0066.153] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0066.153] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0066.302] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0066.310] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0066.310] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0066.310] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x29020c) returned 0x1 [0066.311] SetFocus (hWnd=0x7002e) returned 0x29020c [0066.313] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0066.314] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0066.315] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0066.316] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0066.316] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x29020c, lParam=0x0) returned 0x0 [0066.320] IsWindow (hWnd=0x7002e) returned 1 [0066.320] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0066.320] IsWindow (hWnd=0x7002e) returned 1 [0066.320] SetFocus (hWnd=0x7002e) returned 0x7002e [0066.320] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0066.320] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0066.320] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0066.323] GetProcessWindowStation () returned 0x13c [0066.323] GetActiveWindow () returned 0x7002e [0066.323] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0066.323] GetCurrentThreadId () returned 0x540 [0066.324] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c426a, lParam=0x0) returned 1 [0066.324] IsWindowVisible (hWnd=0x7002e) returned 0 [0066.324] IsWindowVisible (hWnd=0x4020e) returned 0 [0066.324] IsWindowVisible (hWnd=0x60044) returned 0 [0066.324] IsWindowVisible (hWnd=0x2021a) returned 0 [0066.324] IsWindowVisible (hWnd=0x8004a) returned 0 [0066.324] GetActiveWindow () returned 0x7002e [0066.324] GetFocus () returned 0x7002e [0066.324] MessageBoxW (hWnd=0x7002e, lpText="2wb3fAD8mFj8c4Ka/Z8XPw==", lpCaption="", uType=0x0) returned 1 [0066.325] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0066.326] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0066.326] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0066.327] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0066.327] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0066.327] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0066.333] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x2a020c) returned 0x1 [0066.334] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0066.334] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0066.507] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0066.530] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0066.530] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0066.530] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x2a020c) returned 0x1 [0066.531] SetFocus (hWnd=0x7002e) returned 0x2a020c [0066.535] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0066.545] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0066.545] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0066.545] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0066.545] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x2a020c, lParam=0x0) returned 0x0 [0066.552] IsWindow (hWnd=0x7002e) returned 1 [0066.552] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0066.552] IsWindow (hWnd=0x7002e) returned 1 [0066.552] SetFocus (hWnd=0x7002e) returned 0x7002e [0066.553] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0066.553] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0066.553] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0066.553] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x75 [0066.553] GetLastError () returned 0x0 [0066.553] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml", dwFileAttributes=0x80) returned 1 [0066.554] GetLastError () returned 0x0 [0066.554] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x75 [0066.554] GetLastError () returned 0x0 [0066.554] SetErrorMode (uMode=0x1) returned 0x0 [0066.554] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0066.554] GetLastError () returned 0x0 [0066.554] GetFileType (hFile=0x444) returned 0x1 [0066.555] SetErrorMode (uMode=0x0) returned 0x1 [0066.555] GetFileType (hFile=0x444) returned 0x1 [0066.555] GetFileSize (in: hFile=0x444, lpFileSizeHigh=0x8fe9a4 | out: lpFileSizeHigh=0x8fe9a4*=0x0) returned 0xe71c [0066.555] GetLastError () returned 0x0 [0066.557] ReadFile (in: hFile=0x444, lpBuffer=0x2aa3bdc, nNumberOfBytesToRead=0xe71c, lpNumberOfBytesRead=0x8fe94c, lpOverlapped=0x0 | out: lpBuffer=0x2aa3bdc*, lpNumberOfBytesRead=0x8fe94c*=0xe71c, lpOverlapped=0x0) returned 1 [0066.559] GetLastError () returned 0x0 [0066.559] CloseHandle (hObject=0x444) returned 1 [0066.559] GetLastError () returned 0x0 [0066.560] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0066.560] GetLastError () returned 0x0 [0066.560] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8f4 | out: phKey=0x8fe8f4*=0x9f5ba0) returned 1 [0066.560] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0066.560] GetLastError () returned 0x0 [0066.560] CryptSetKeyParam (hKey=0x9f5ba0, dwParam=0x4, pbData=0x2ab236c*=0x1, dwFlags=0x0) returned 1 [0066.560] GetLastError () returned 0x0 [0066.560] CryptSetKeyParam (hKey=0x9f5ba0, dwParam=0x1, pbData=0x2ab2338, dwFlags=0x0) returned 1 [0066.560] GetLastError () returned 0x0 [0066.561] CryptEncrypt (in: hKey=0x9f5ba0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2ab237c*, pdwDataLen=0x8fe9ac*=0xe720, dwBufLen=0xe720 | out: pbData=0x2ab237c*, pdwDataLen=0x8fe9ac*=0xe720) returned 1 [0066.561] GetLastError () returned 0x0 [0066.561] CryptEncrypt (in: hKey=0x9f5ba0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ac0abc*, pdwDataLen=0x8fe9b4*=0x0, dwBufLen=0x10 | out: pbData=0x2ac0abc*, pdwDataLen=0x8fe9b4*=0x10) returned 1 [0066.561] GetLastError () returned 0x0 [0066.561] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x75 [0066.561] GetLastError () returned 0x0 [0066.561] SetErrorMode (uMode=0x1) returned 0x0 [0066.561] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0066.563] GetLastError () returned 0xb7 [0066.563] GetFileType (hFile=0x444) returned 0x1 [0066.563] SetErrorMode (uMode=0x0) returned 0x1 [0066.563] GetFileType (hFile=0x444) returned 0x1 [0066.563] WriteFile (in: hFile=0x444, lpBuffer=0x2ab237c*, nNumberOfBytesToWrite=0xe720, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2ab237c*, lpNumberOfBytesWritten=0x8fe958*=0xe720, lpOverlapped=0x0) returned 1 [0066.565] GetLastError () returned 0xb7 [0066.565] CloseHandle (hObject=0x444) returned 1 [0066.567] GetLastError () returned 0xb7 [0066.567] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml.2wb3fAD8mFj8c4Ka#Z8XPw==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml.2wb3fAD8mFj8c4Ka#Z8XPw==.bwall", lpFilePart=0x0) returned 0x94 [0066.567] GetLastError () returned 0xb7 [0066.567] SetErrorMode (uMode=0x1) returned 0x0 [0066.567] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml.2wb3fAD8mFj8c4Ka#Z8XPw==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml.2wb3fad8mfj8c4ka#z8xpw==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0066.568] GetLastError () returned 0x0 [0066.568] GetFileType (hFile=0x444) returned 0x1 [0066.568] SetErrorMode (uMode=0x0) returned 0x1 [0066.568] GetFileType (hFile=0x444) returned 0x1 [0066.568] WriteFile (in: hFile=0x444, lpBuffer=0x2ab237c*, nNumberOfBytesToWrite=0xe720, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2ab237c*, lpNumberOfBytesWritten=0x8fe958*=0xe720, lpOverlapped=0x0) returned 1 [0066.570] GetLastError () returned 0x0 [0066.570] CloseHandle (hObject=0x444) returned 1 [0066.572] GetLastError () returned 0x0 [0066.572] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x75 [0066.572] GetLastError () returned 0x0 [0066.572] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml")) returned 1 [0066.573] GetLastError () returned 0x0 [0066.574] GetProcessWindowStation () returned 0x13c [0066.574] GetActiveWindow () returned 0x7002e [0066.574] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0066.574] GetCurrentThreadId () returned 0x540 [0066.574] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c447a, lParam=0x0) returned 1 [0066.575] IsWindowVisible (hWnd=0x7002e) returned 0 [0066.575] IsWindowVisible (hWnd=0x4020e) returned 0 [0066.575] IsWindowVisible (hWnd=0x60044) returned 0 [0066.575] IsWindowVisible (hWnd=0x2021a) returned 0 [0066.576] IsWindowVisible (hWnd=0x8004a) returned 0 [0066.576] GetActiveWindow () returned 0x7002e [0066.576] GetFocus () returned 0x7002e [0066.576] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0066.577] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0066.577] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0066.578] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0066.579] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0066.579] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0066.579] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0066.586] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x2b020c) returned 0x1 [0066.589] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0066.589] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0066.709] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0066.717] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0066.717] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0066.717] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x2b020c) returned 0x1 [0066.718] SetFocus (hWnd=0x7002e) returned 0x2b020c [0066.720] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0066.721] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0066.721] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0066.721] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0066.722] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x2b020c, lParam=0x0) returned 0x0 [0066.726] IsWindow (hWnd=0x7002e) returned 1 [0066.726] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0066.726] IsWindow (hWnd=0x7002e) returned 1 [0066.726] SetFocus (hWnd=0x7002e) returned 0x7002e [0066.726] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0066.726] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0066.726] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0066.726] GetProcessWindowStation () returned 0x13c [0066.726] GetActiveWindow () returned 0x7002e [0066.726] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0066.727] GetCurrentThreadId () returned 0x540 [0066.727] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c44da, lParam=0x0) returned 1 [0066.731] IsWindowVisible (hWnd=0x7002e) returned 0 [0066.731] IsWindowVisible (hWnd=0x4020e) returned 0 [0066.731] IsWindowVisible (hWnd=0x60044) returned 0 [0066.731] IsWindowVisible (hWnd=0x2021a) returned 0 [0066.731] IsWindowVisible (hWnd=0x8004a) returned 0 [0066.731] GetActiveWindow () returned 0x7002e [0066.731] GetFocus () returned 0x7002e [0066.731] MessageBoxW (hWnd=0x7002e, lpText="+4ic7kggLdSV3rCia30zgw==", lpCaption="", uType=0x0) returned 1 [0066.732] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0066.733] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0066.733] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0066.734] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0066.734] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0066.734] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0066.740] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x2c020c) returned 0x1 [0066.741] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0066.741] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0066.915] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0066.923] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0066.924] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0066.924] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x2c020c) returned 0x1 [0066.925] SetFocus (hWnd=0x7002e) returned 0x2c020c [0066.927] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0066.928] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0066.928] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0066.929] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0066.929] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x2c020c, lParam=0x0) returned 0x0 [0066.935] IsWindow (hWnd=0x7002e) returned 1 [0066.935] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0066.935] IsWindow (hWnd=0x7002e) returned 1 [0066.935] SetFocus (hWnd=0x7002e) returned 0x7002e [0066.936] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0066.936] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0066.936] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0066.936] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml", lpFilePart=0x0) returned 0x78 [0066.936] GetLastError () returned 0x0 [0066.936] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml", dwFileAttributes=0x80) returned 1 [0066.937] GetLastError () returned 0x0 [0066.937] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml", lpFilePart=0x0) returned 0x78 [0066.937] GetLastError () returned 0x0 [0066.937] SetErrorMode (uMode=0x1) returned 0x0 [0066.938] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0066.938] GetLastError () returned 0x0 [0066.938] GetFileType (hFile=0x444) returned 0x1 [0066.938] SetErrorMode (uMode=0x0) returned 0x1 [0066.938] GetFileType (hFile=0x444) returned 0x1 [0066.938] GetFileSize (in: hFile=0x444, lpFileSizeHigh=0x8fe9a4 | out: lpFileSizeHigh=0x8fe9a4*=0x0) returned 0x7fa [0066.938] GetLastError () returned 0x0 [0066.938] ReadFile (in: hFile=0x444, lpBuffer=0x2ac68bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe94c, lpOverlapped=0x0 | out: lpBuffer=0x2ac68bc*, lpNumberOfBytesRead=0x8fe94c*=0x7fa, lpOverlapped=0x0) returned 1 [0066.939] GetLastError () returned 0x0 [0066.939] CloseHandle (hObject=0x444) returned 1 [0066.940] GetLastError () returned 0x0 [0066.940] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0066.940] GetLastError () returned 0x0 [0066.940] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8f4 | out: phKey=0x8fe8f4*=0x9f6720) returned 1 [0066.940] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0066.940] GetLastError () returned 0x0 [0066.940] CryptSetKeyParam (hKey=0x9f6720, dwParam=0x4, pbData=0x2ac7930*=0x1, dwFlags=0x0) returned 1 [0066.940] GetLastError () returned 0x0 [0066.940] CryptSetKeyParam (hKey=0x9f6720, dwParam=0x1, pbData=0x2ac78fc, dwFlags=0x0) returned 1 [0066.940] GetLastError () returned 0x0 [0066.940] CryptEncrypt (in: hKey=0x9f6720, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2ac7940*, pdwDataLen=0x8fe9ac*=0x800, dwBufLen=0x800 | out: pbData=0x2ac7940*, pdwDataLen=0x8fe9ac*=0x800) returned 1 [0066.940] GetLastError () returned 0x0 [0066.940] CryptEncrypt (in: hKey=0x9f6720, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ac8160*, pdwDataLen=0x8fe9b4*=0x0, dwBufLen=0x10 | out: pbData=0x2ac8160*, pdwDataLen=0x8fe9b4*=0x10) returned 1 [0066.940] GetLastError () returned 0x0 [0066.940] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml", lpFilePart=0x0) returned 0x78 [0066.940] GetLastError () returned 0x0 [0066.940] SetErrorMode (uMode=0x1) returned 0x0 [0066.940] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0066.941] GetLastError () returned 0xb7 [0066.941] GetFileType (hFile=0x444) returned 0x1 [0066.941] SetErrorMode (uMode=0x0) returned 0x1 [0066.941] GetFileType (hFile=0x444) returned 0x1 [0066.942] WriteFile (in: hFile=0x444, lpBuffer=0x2ac85f8*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x8fe920, lpOverlapped=0x0 | out: lpBuffer=0x2ac85f8*, lpNumberOfBytesWritten=0x8fe920*=0x800, lpOverlapped=0x0) returned 1 [0066.942] GetLastError () returned 0xb7 [0066.942] CloseHandle (hObject=0x444) returned 1 [0066.943] GetLastError () returned 0xb7 [0066.943] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml.+4ic7kggLdSV3rCia30zgw==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml.+4ic7kggLdSV3rCia30zgw==.bwall", lpFilePart=0x0) returned 0x97 [0066.943] GetLastError () returned 0xb7 [0066.943] SetErrorMode (uMode=0x1) returned 0x0 [0066.944] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml.+4ic7kggLdSV3rCia30zgw==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml.+4ic7kggldsv3rcia30zgw==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0066.944] GetLastError () returned 0x0 [0066.944] GetFileType (hFile=0x444) returned 0x1 [0066.944] SetErrorMode (uMode=0x0) returned 0x1 [0066.945] GetFileType (hFile=0x444) returned 0x1 [0066.945] WriteFile (in: hFile=0x444, lpBuffer=0x2ac9944*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x8fe920, lpOverlapped=0x0 | out: lpBuffer=0x2ac9944*, lpNumberOfBytesWritten=0x8fe920*=0x800, lpOverlapped=0x0) returned 1 [0066.945] GetLastError () returned 0x0 [0066.948] CloseHandle (hObject=0x444) returned 1 [0066.948] GetLastError () returned 0x0 [0066.948] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml", lpFilePart=0x0) returned 0x78 [0066.948] GetLastError () returned 0x0 [0066.948] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml")) returned 1 [0066.949] GetLastError () returned 0x0 [0066.949] GetProcessWindowStation () returned 0x13c [0066.949] GetActiveWindow () returned 0x7002e [0066.949] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0066.949] GetCurrentThreadId () returned 0x540 [0066.950] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c44aa, lParam=0x0) returned 1 [0066.950] IsWindowVisible (hWnd=0x7002e) returned 0 [0066.950] IsWindowVisible (hWnd=0x4020e) returned 0 [0066.950] IsWindowVisible (hWnd=0x60044) returned 0 [0066.950] IsWindowVisible (hWnd=0x2021a) returned 0 [0066.950] IsWindowVisible (hWnd=0x8004a) returned 0 [0066.950] GetActiveWindow () returned 0x7002e [0066.950] GetFocus () returned 0x7002e [0066.950] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0066.951] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0066.951] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0066.952] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0066.952] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0066.952] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0066.953] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0066.959] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x2d020c) returned 0x1 [0066.960] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0066.960] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0067.105] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0067.113] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0067.113] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0067.113] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x2d020c) returned 0x1 [0067.114] SetFocus (hWnd=0x7002e) returned 0x2d020c [0067.116] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0067.117] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0067.117] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0067.121] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0067.121] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x2d020c, lParam=0x0) returned 0x0 [0067.126] IsWindow (hWnd=0x7002e) returned 1 [0067.126] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0067.126] IsWindow (hWnd=0x7002e) returned 1 [0067.126] SetFocus (hWnd=0x7002e) returned 0x7002e [0067.126] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0067.126] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0067.126] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0067.126] GetProcessWindowStation () returned 0x13c [0067.126] GetActiveWindow () returned 0x7002e [0067.127] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0067.127] GetCurrentThreadId () returned 0x540 [0067.127] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c453a, lParam=0x0) returned 1 [0067.127] IsWindowVisible (hWnd=0x7002e) returned 0 [0067.127] IsWindowVisible (hWnd=0x4020e) returned 0 [0067.127] IsWindowVisible (hWnd=0x60044) returned 0 [0067.127] IsWindowVisible (hWnd=0x2021a) returned 0 [0067.127] IsWindowVisible (hWnd=0x8004a) returned 0 [0067.127] GetActiveWindow () returned 0x7002e [0067.127] GetFocus () returned 0x7002e [0067.127] MessageBoxW (hWnd=0x7002e, lpText="FFv92suGiV1lwzj85lU2Sg==", lpCaption="", uType=0x0) returned 1 [0067.128] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0067.129] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0067.129] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0067.130] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0067.130] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0067.130] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0067.140] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x2e020c) returned 0x1 [0067.141] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0067.141] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0067.308] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0067.315] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0067.315] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0067.315] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x2e020c) returned 0x1 [0067.318] SetFocus (hWnd=0x7002e) returned 0x2e020c [0067.320] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0067.324] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0067.324] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0067.325] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0067.325] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x2e020c, lParam=0x0) returned 0x0 [0067.329] IsWindow (hWnd=0x7002e) returned 1 [0067.329] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0067.329] IsWindow (hWnd=0x7002e) returned 1 [0067.329] SetFocus (hWnd=0x7002e) returned 0x7002e [0067.329] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0067.329] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0067.329] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0067.330] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7b [0067.330] GetLastError () returned 0x0 [0067.330] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", dwFileAttributes=0x80) returned 1 [0067.330] GetLastError () returned 0x0 [0067.330] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7b [0067.330] GetLastError () returned 0x0 [0067.330] SetErrorMode (uMode=0x1) returned 0x0 [0067.330] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0067.330] GetLastError () returned 0x0 [0067.330] GetFileType (hFile=0x444) returned 0x1 [0067.331] SetErrorMode (uMode=0x0) returned 0x1 [0067.331] GetFileType (hFile=0x444) returned 0x1 [0067.331] GetFileSize (in: hFile=0x444, lpFileSizeHigh=0x8fe9a4 | out: lpFileSizeHigh=0x8fe9a4*=0x0) returned 0x3f14 [0067.331] GetLastError () returned 0x0 [0067.331] ReadFile (in: hFile=0x444, lpBuffer=0x2acf764, nNumberOfBytesToRead=0x3f14, lpNumberOfBytesRead=0x8fe94c, lpOverlapped=0x0 | out: lpBuffer=0x2acf764*, lpNumberOfBytesRead=0x8fe94c*=0x3f14, lpOverlapped=0x0) returned 1 [0067.332] GetLastError () returned 0x0 [0067.332] CloseHandle (hObject=0x444) returned 1 [0067.332] GetLastError () returned 0x0 [0067.332] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0067.332] GetLastError () returned 0x0 [0067.332] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8f4 | out: phKey=0x8fe8f4*=0x9f66e0) returned 1 [0067.333] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0067.333] GetLastError () returned 0x0 [0067.333] CryptSetKeyParam (hKey=0x9f66e0, dwParam=0x4, pbData=0x2ad36ec*=0x1, dwFlags=0x0) returned 1 [0067.333] GetLastError () returned 0x0 [0067.333] CryptSetKeyParam (hKey=0x9f66e0, dwParam=0x1, pbData=0x2ad36b8, dwFlags=0x0) returned 1 [0067.333] GetLastError () returned 0x0 [0067.333] CryptEncrypt (in: hKey=0x9f66e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2ad36fc*, pdwDataLen=0x8fe9ac*=0x3f20, dwBufLen=0x3f20 | out: pbData=0x2ad36fc*, pdwDataLen=0x8fe9ac*=0x3f20) returned 1 [0067.333] GetLastError () returned 0x0 [0067.333] CryptEncrypt (in: hKey=0x9f66e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ad763c*, pdwDataLen=0x8fe9b4*=0x0, dwBufLen=0x10 | out: pbData=0x2ad763c*, pdwDataLen=0x8fe9b4*=0x10) returned 1 [0067.333] GetLastError () returned 0x0 [0067.333] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7b [0067.333] GetLastError () returned 0x0 [0067.333] SetErrorMode (uMode=0x1) returned 0x0 [0067.333] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0067.334] GetLastError () returned 0xb7 [0067.334] GetFileType (hFile=0x444) returned 0x1 [0067.334] SetErrorMode (uMode=0x0) returned 0x1 [0067.334] GetFileType (hFile=0x444) returned 0x1 [0067.334] WriteFile (in: hFile=0x444, lpBuffer=0x2ad36fc*, nNumberOfBytesToWrite=0x3f20, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2ad36fc*, lpNumberOfBytesWritten=0x8fe958*=0x3f20, lpOverlapped=0x0) returned 1 [0067.335] GetLastError () returned 0xb7 [0067.336] CloseHandle (hObject=0x444) returned 1 [0067.356] GetLastError () returned 0xb7 [0067.356] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.FFv92suGiV1lwzj85lU2Sg==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.FFv92suGiV1lwzj85lU2Sg==.bwall", lpFilePart=0x0) returned 0x9a [0067.356] GetLastError () returned 0xb7 [0067.356] SetErrorMode (uMode=0x1) returned 0x0 [0067.356] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.FFv92suGiV1lwzj85lU2Sg==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml.ffv92sugiv1lwzj85lu2sg==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0067.357] GetLastError () returned 0x0 [0067.357] GetFileType (hFile=0x444) returned 0x1 [0067.357] SetErrorMode (uMode=0x0) returned 0x1 [0067.357] GetFileType (hFile=0x444) returned 0x1 [0067.358] WriteFile (in: hFile=0x444, lpBuffer=0x2ad36fc*, nNumberOfBytesToWrite=0x3f20, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2ad36fc*, lpNumberOfBytesWritten=0x8fe958*=0x3f20, lpOverlapped=0x0) returned 1 [0067.359] GetLastError () returned 0x0 [0067.359] CloseHandle (hObject=0x444) returned 1 [0067.359] GetLastError () returned 0x0 [0067.359] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7b [0067.359] GetLastError () returned 0x0 [0067.359] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml")) returned 1 [0067.360] GetLastError () returned 0x0 [0067.361] GetProcessWindowStation () returned 0x13c [0067.361] GetActiveWindow () returned 0x7002e [0067.361] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0067.361] GetCurrentThreadId () returned 0x540 [0067.361] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c43ea, lParam=0x0) returned 1 [0067.362] IsWindowVisible (hWnd=0x7002e) returned 0 [0067.362] IsWindowVisible (hWnd=0x4020e) returned 0 [0067.362] IsWindowVisible (hWnd=0x60044) returned 0 [0067.362] IsWindowVisible (hWnd=0x2021a) returned 0 [0067.362] IsWindowVisible (hWnd=0x8004a) returned 0 [0067.362] GetActiveWindow () returned 0x7002e [0067.362] GetFocus () returned 0x7002e [0067.362] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0067.364] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0067.365] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0067.366] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0067.366] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0067.366] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0067.366] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0067.376] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x2f020c) returned 0x1 [0067.377] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0067.377] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0067.514] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0067.522] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0067.522] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0067.522] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x2f020c) returned 0x1 [0067.523] SetFocus (hWnd=0x7002e) returned 0x2f020c [0067.526] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0067.527] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0067.527] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0067.528] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0067.528] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x2f020c, lParam=0x0) returned 0x0 [0067.532] IsWindow (hWnd=0x7002e) returned 1 [0067.532] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0067.532] IsWindow (hWnd=0x7002e) returned 1 [0067.532] SetFocus (hWnd=0x7002e) returned 0x7002e [0067.532] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0067.532] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0067.532] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0067.533] GetProcessWindowStation () returned 0x13c [0067.533] GetActiveWindow () returned 0x7002e [0067.533] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0067.533] GetCurrentThreadId () returned 0x540 [0067.533] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c41da, lParam=0x0) returned 1 [0067.533] IsWindowVisible (hWnd=0x7002e) returned 0 [0067.533] IsWindowVisible (hWnd=0x4020e) returned 0 [0067.533] IsWindowVisible (hWnd=0x60044) returned 0 [0067.533] IsWindowVisible (hWnd=0x2021a) returned 0 [0067.533] IsWindowVisible (hWnd=0x8004a) returned 0 [0067.534] GetActiveWindow () returned 0x7002e [0067.534] GetFocus () returned 0x7002e [0067.534] MessageBoxW (hWnd=0x7002e, lpText="j+wGaTu+tSy1a7DK3x6HhQ==", lpCaption="", uType=0x0) returned 1 [0067.535] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0067.535] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0067.536] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0067.536] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0067.536] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0067.536] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0067.545] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x30020c) returned 0x1 [0067.546] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0067.546] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0067.773] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0067.781] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0067.781] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0067.781] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x30020c) returned 0x1 [0067.782] SetFocus (hWnd=0x7002e) returned 0x30020c [0067.784] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0067.785] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0067.785] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0067.786] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0067.786] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x30020c, lParam=0x0) returned 0x0 [0067.792] IsWindow (hWnd=0x7002e) returned 1 [0067.792] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0067.792] IsWindow (hWnd=0x7002e) returned 1 [0067.792] SetFocus (hWnd=0x7002e) returned 0x7002e [0067.792] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0067.792] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0067.792] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0067.792] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x72 [0067.792] GetLastError () returned 0x0 [0067.793] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml", dwFileAttributes=0x80) returned 1 [0067.793] GetLastError () returned 0x0 [0067.793] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x72 [0067.793] GetLastError () returned 0x0 [0067.793] SetErrorMode (uMode=0x1) returned 0x0 [0067.793] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0067.793] GetLastError () returned 0x0 [0067.794] GetFileType (hFile=0x444) returned 0x1 [0067.794] SetErrorMode (uMode=0x0) returned 0x1 [0067.794] GetFileType (hFile=0x444) returned 0x1 [0067.794] GetFileSize (in: hFile=0x444, lpFileSizeHigh=0x8fe9a4 | out: lpFileSizeHigh=0x8fe9a4*=0x0) returned 0x265a [0067.794] GetLastError () returned 0x0 [0067.794] ReadFile (in: hFile=0x444, lpBuffer=0x2adcc14, nNumberOfBytesToRead=0x265a, lpNumberOfBytesRead=0x8fe94c, lpOverlapped=0x0 | out: lpBuffer=0x2adcc14*, lpNumberOfBytesRead=0x8fe94c*=0x265a, lpOverlapped=0x0) returned 1 [0067.796] GetLastError () returned 0x0 [0067.797] CloseHandle (hObject=0x444) returned 1 [0067.797] GetLastError () returned 0x0 [0067.797] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0067.797] GetLastError () returned 0x0 [0067.797] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8f4 | out: phKey=0x8fe8f4*=0x9f6760) returned 1 [0067.797] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0067.797] GetLastError () returned 0x0 [0067.797] CryptSetKeyParam (hKey=0x9f6760, dwParam=0x4, pbData=0x2adf2e4*=0x1, dwFlags=0x0) returned 1 [0067.797] GetLastError () returned 0x0 [0067.797] CryptSetKeyParam (hKey=0x9f6760, dwParam=0x1, pbData=0x2adf2b0, dwFlags=0x0) returned 1 [0067.797] GetLastError () returned 0x0 [0067.797] CryptEncrypt (in: hKey=0x9f6760, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2adf2f4*, pdwDataLen=0x8fe9ac*=0x2660, dwBufLen=0x2660 | out: pbData=0x2adf2f4*, pdwDataLen=0x8fe9ac*=0x2660) returned 1 [0067.797] GetLastError () returned 0x0 [0067.797] CryptEncrypt (in: hKey=0x9f6760, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ae1974*, pdwDataLen=0x8fe9b4*=0x0, dwBufLen=0x10 | out: pbData=0x2ae1974*, pdwDataLen=0x8fe9b4*=0x10) returned 1 [0067.798] GetLastError () returned 0x0 [0067.798] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x72 [0067.798] GetLastError () returned 0x0 [0067.798] SetErrorMode (uMode=0x1) returned 0x0 [0067.798] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0067.799] GetLastError () returned 0xb7 [0067.799] GetFileType (hFile=0x444) returned 0x1 [0067.799] SetErrorMode (uMode=0x0) returned 0x1 [0067.799] GetFileType (hFile=0x444) returned 0x1 [0067.799] WriteFile (in: hFile=0x444, lpBuffer=0x2adf2f4*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2adf2f4*, lpNumberOfBytesWritten=0x8fe958*=0x2660, lpOverlapped=0x0) returned 1 [0067.800] GetLastError () returned 0xb7 [0067.800] CloseHandle (hObject=0x444) returned 1 [0067.801] GetLastError () returned 0xb7 [0067.801] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml.j+wGaTu+tSy1a7DK3x6HhQ==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml.j+wGaTu+tSy1a7DK3x6HhQ==.bwall", lpFilePart=0x0) returned 0x91 [0067.801] GetLastError () returned 0xb7 [0067.801] SetErrorMode (uMode=0x1) returned 0x0 [0067.801] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml.j+wGaTu+tSy1a7DK3x6HhQ==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml.j+wgatu+tsy1a7dk3x6hhq==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0067.801] GetLastError () returned 0x0 [0067.801] GetFileType (hFile=0x444) returned 0x1 [0067.802] SetErrorMode (uMode=0x0) returned 0x1 [0067.802] GetFileType (hFile=0x444) returned 0x1 [0067.802] WriteFile (in: hFile=0x444, lpBuffer=0x2adf2f4*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2adf2f4*, lpNumberOfBytesWritten=0x8fe958*=0x2660, lpOverlapped=0x0) returned 1 [0067.803] GetLastError () returned 0x0 [0067.803] CloseHandle (hObject=0x444) returned 1 [0067.803] GetLastError () returned 0x0 [0067.803] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x72 [0067.803] GetLastError () returned 0x0 [0067.803] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml")) returned 1 [0067.804] GetLastError () returned 0x0 [0067.804] GetProcessWindowStation () returned 0x13c [0067.804] GetActiveWindow () returned 0x7002e [0067.805] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0067.805] GetCurrentThreadId () returned 0x540 [0067.805] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c42fa, lParam=0x0) returned 1 [0067.805] IsWindowVisible (hWnd=0x7002e) returned 0 [0067.805] IsWindowVisible (hWnd=0x4020e) returned 0 [0067.805] IsWindowVisible (hWnd=0x60044) returned 0 [0067.805] IsWindowVisible (hWnd=0x2021a) returned 0 [0067.805] IsWindowVisible (hWnd=0x8004a) returned 0 [0067.806] GetActiveWindow () returned 0x7002e [0067.806] GetFocus () returned 0x7002e [0067.806] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0067.807] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0067.807] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0067.808] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0067.808] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0067.808] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0067.808] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0067.815] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x31020c) returned 0x1 [0067.816] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0067.816] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0068.078] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0068.085] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0068.085] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0068.086] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x31020c) returned 0x1 [0068.090] SetFocus (hWnd=0x7002e) returned 0x31020c [0068.092] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0068.093] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0068.093] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0068.094] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0068.094] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x31020c, lParam=0x0) returned 0x0 [0068.098] IsWindow (hWnd=0x7002e) returned 1 [0068.098] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0068.098] IsWindow (hWnd=0x7002e) returned 1 [0068.098] SetFocus (hWnd=0x7002e) returned 0x7002e [0068.098] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0068.098] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0068.098] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0068.099] GetProcessWindowStation () returned 0x13c [0068.099] GetActiveWindow () returned 0x7002e [0068.099] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0068.099] GetCurrentThreadId () returned 0x540 [0068.099] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c420a, lParam=0x0) returned 1 [0068.099] IsWindowVisible (hWnd=0x7002e) returned 0 [0068.099] IsWindowVisible (hWnd=0x4020e) returned 0 [0068.099] IsWindowVisible (hWnd=0x60044) returned 0 [0068.099] IsWindowVisible (hWnd=0x2021a) returned 0 [0068.099] IsWindowVisible (hWnd=0x8004a) returned 0 [0068.099] GetActiveWindow () returned 0x7002e [0068.100] GetFocus () returned 0x7002e [0068.100] MessageBoxW (hWnd=0x7002e, lpText="g3/5SQ3oV3d6E8DhVoKtCA==", lpCaption="", uType=0x0) returned 1 [0068.100] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0068.101] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0068.102] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0068.104] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0068.104] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0068.105] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0068.111] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x32020c) returned 0x1 [0068.112] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0068.112] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0068.387] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0068.395] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0068.395] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0068.395] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x32020c) returned 0x1 [0068.396] SetFocus (hWnd=0x7002e) returned 0x32020c [0068.398] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0068.424] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0068.424] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0068.425] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0068.425] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x32020c, lParam=0x0) returned 0x0 [0068.430] IsWindow (hWnd=0x7002e) returned 1 [0068.430] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0068.444] IsWindow (hWnd=0x7002e) returned 1 [0068.444] SetFocus (hWnd=0x7002e) returned 0x7002e [0068.444] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0068.444] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0068.468] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0068.468] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7f [0068.468] GetLastError () returned 0x0 [0068.468] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", dwFileAttributes=0x80) returned 1 [0068.470] GetLastError () returned 0x0 [0068.470] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7f [0068.470] GetLastError () returned 0x0 [0068.470] SetErrorMode (uMode=0x1) returned 0x0 [0068.470] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0068.470] GetLastError () returned 0x0 [0068.470] GetFileType (hFile=0x444) returned 0x1 [0068.470] SetErrorMode (uMode=0x0) returned 0x1 [0068.471] GetFileType (hFile=0x444) returned 0x1 [0068.471] GetFileSize (in: hFile=0x444, lpFileSizeHigh=0x8fe9a4 | out: lpFileSizeHigh=0x8fe9a4*=0x0) returned 0x39d9c [0068.471] GetLastError () returned 0x0 [0068.567] ReadFile (in: hFile=0x444, lpBuffer=0x3a18010, nNumberOfBytesToRead=0x39d9c, lpNumberOfBytesRead=0x8fe94c, lpOverlapped=0x0 | out: lpBuffer=0x3a18010*, lpNumberOfBytesRead=0x8fe94c*=0x39d9c, lpOverlapped=0x0) returned 1 [0068.573] GetLastError () returned 0x0 [0068.573] CloseHandle (hObject=0x444) returned 1 [0068.573] GetLastError () returned 0x0 [0068.573] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0068.573] GetLastError () returned 0x0 [0068.573] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8f4 | out: phKey=0x8fe8f4*=0x9f67a0) returned 1 [0068.574] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0068.574] GetLastError () returned 0x0 [0068.574] CryptSetKeyParam (hKey=0x9f67a0, dwParam=0x4, pbData=0x2a390c8*=0x1, dwFlags=0x0) returned 1 [0068.574] GetLastError () returned 0x0 [0068.574] CryptSetKeyParam (hKey=0x9f67a0, dwParam=0x1, pbData=0x2a39094, dwFlags=0x0) returned 1 [0068.574] GetLastError () returned 0x0 [0068.578] CryptEncrypt (in: hKey=0x9f67a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a51dc8*, pdwDataLen=0x8fe9ac*=0x39da0, dwBufLen=0x39da0 | out: pbData=0x3a51dc8*, pdwDataLen=0x8fe9ac*=0x39da0) returned 1 [0068.579] GetLastError () returned 0x0 [0068.579] CryptEncrypt (in: hKey=0x9f67a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2a390ec*, pdwDataLen=0x8fe9b4*=0x0, dwBufLen=0x10 | out: pbData=0x2a390ec*, pdwDataLen=0x8fe9b4*=0x10) returned 1 [0068.579] GetLastError () returned 0x0 [0068.579] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7f [0068.579] GetLastError () returned 0x0 [0068.579] SetErrorMode (uMode=0x1) returned 0x0 [0068.579] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0068.581] GetLastError () returned 0xb7 [0068.581] GetFileType (hFile=0x444) returned 0x1 [0068.581] SetErrorMode (uMode=0x0) returned 0x1 [0068.581] GetFileType (hFile=0x444) returned 0x1 [0068.581] WriteFile (in: hFile=0x444, lpBuffer=0x3a51dc8*, nNumberOfBytesToWrite=0x39da0, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x3a51dc8*, lpNumberOfBytesWritten=0x8fe958*=0x39da0, lpOverlapped=0x0) returned 1 [0068.585] GetLastError () returned 0xb7 [0068.585] CloseHandle (hObject=0x444) returned 1 [0068.592] GetLastError () returned 0xb7 [0068.592] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.g3#5SQ3oV3d6E8DhVoKtCA==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.g3#5SQ3oV3d6E8DhVoKtCA==.bwall", lpFilePart=0x0) returned 0x9e [0068.592] GetLastError () returned 0xb7 [0068.592] SetErrorMode (uMode=0x1) returned 0x0 [0068.592] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.g3#5SQ3oV3d6E8DhVoKtCA==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml.g3#5sq3ov3d6e8dhvoktca==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0068.593] GetLastError () returned 0x0 [0068.593] GetFileType (hFile=0x444) returned 0x1 [0068.593] SetErrorMode (uMode=0x0) returned 0x1 [0068.593] GetFileType (hFile=0x444) returned 0x1 [0068.593] WriteFile (in: hFile=0x444, lpBuffer=0x3a51dc8*, nNumberOfBytesToWrite=0x39da0, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x3a51dc8*, lpNumberOfBytesWritten=0x8fe958*=0x39da0, lpOverlapped=0x0) returned 1 [0068.597] GetLastError () returned 0x0 [0068.597] CloseHandle (hObject=0x444) returned 1 [0068.601] GetLastError () returned 0x0 [0068.601] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7f [0068.601] GetLastError () returned 0x0 [0068.601] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml")) returned 1 [0068.605] GetLastError () returned 0x0 [0068.611] GetProcessWindowStation () returned 0x13c [0068.611] GetActiveWindow () returned 0x7002e [0068.611] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0068.611] GetCurrentThreadId () returned 0x540 [0068.611] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c423a, lParam=0x0) returned 1 [0068.611] IsWindowVisible (hWnd=0x7002e) returned 0 [0068.611] IsWindowVisible (hWnd=0x4020e) returned 0 [0068.611] IsWindowVisible (hWnd=0x60044) returned 0 [0068.612] IsWindowVisible (hWnd=0x2021a) returned 0 [0068.612] IsWindowVisible (hWnd=0x8004a) returned 0 [0068.612] GetActiveWindow () returned 0x7002e [0068.612] GetFocus () returned 0x7002e [0068.612] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0068.613] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0068.613] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0068.614] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0068.614] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0068.614] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0068.615] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0068.622] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x33020c) returned 0x1 [0068.623] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0068.623] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0069.021] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0069.082] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0069.082] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0069.083] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x33020c) returned 0x1 [0069.084] SetFocus (hWnd=0x7002e) returned 0x33020c [0069.086] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0069.091] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0069.091] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0069.091] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0069.091] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x33020c, lParam=0x0) returned 0x0 [0069.096] IsWindow (hWnd=0x7002e) returned 1 [0069.096] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0069.096] IsWindow (hWnd=0x7002e) returned 1 [0069.096] SetFocus (hWnd=0x7002e) returned 0x7002e [0069.096] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0069.096] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0069.096] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0069.096] GetProcessWindowStation () returned 0x13c [0069.096] GetActiveWindow () returned 0x7002e [0069.096] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0069.096] GetCurrentThreadId () returned 0x540 [0069.097] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c44aa, lParam=0x0) returned 1 [0069.097] IsWindowVisible (hWnd=0x7002e) returned 0 [0069.097] IsWindowVisible (hWnd=0x4020e) returned 0 [0069.097] IsWindowVisible (hWnd=0x60044) returned 0 [0069.097] IsWindowVisible (hWnd=0x2021a) returned 0 [0069.097] IsWindowVisible (hWnd=0x8004a) returned 0 [0069.097] GetActiveWindow () returned 0x7002e [0069.097] GetFocus () returned 0x7002e [0069.097] MessageBoxW (hWnd=0x7002e, lpText="kFPQxPKemMuM7hDViu5onA==", lpCaption="", uType=0x0) returned 1 [0069.098] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0069.099] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0069.099] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0069.099] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0069.099] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0069.100] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0069.107] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x34020c) returned 0x1 [0069.108] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0069.108] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0069.286] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0069.298] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0069.298] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0069.298] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x34020c) returned 0x1 [0069.300] SetFocus (hWnd=0x7002e) returned 0x34020c [0069.301] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0069.303] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0069.303] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0069.303] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0069.303] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x34020c, lParam=0x0) returned 0x0 [0069.308] IsWindow (hWnd=0x7002e) returned 1 [0069.308] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0069.308] IsWindow (hWnd=0x7002e) returned 1 [0069.308] SetFocus (hWnd=0x7002e) returned 0x7002e [0069.308] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0069.308] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0069.309] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0069.309] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x74 [0069.309] GetLastError () returned 0x0 [0069.309] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml", dwFileAttributes=0x80) returned 1 [0069.310] GetLastError () returned 0x0 [0069.310] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x74 [0069.310] GetLastError () returned 0x0 [0069.310] SetErrorMode (uMode=0x1) returned 0x0 [0069.310] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0069.310] GetLastError () returned 0x0 [0069.310] GetFileType (hFile=0x444) returned 0x1 [0069.310] SetErrorMode (uMode=0x0) returned 0x1 [0069.310] GetFileType (hFile=0x444) returned 0x1 [0069.310] GetFileSize (in: hFile=0x444, lpFileSizeHigh=0x8fe9a4 | out: lpFileSizeHigh=0x8fe9a4*=0x0) returned 0x8f70 [0069.310] GetLastError () returned 0x0 [0069.311] ReadFile (in: hFile=0x444, lpBuffer=0x2a3e838, nNumberOfBytesToRead=0x8f70, lpNumberOfBytesRead=0x8fe94c, lpOverlapped=0x0 | out: lpBuffer=0x2a3e838*, lpNumberOfBytesRead=0x8fe94c*=0x8f70, lpOverlapped=0x0) returned 1 [0069.312] GetLastError () returned 0x0 [0069.312] CloseHandle (hObject=0x444) returned 1 [0069.312] GetLastError () returned 0x0 [0069.312] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0069.312] GetLastError () returned 0x0 [0069.312] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8f4 | out: phKey=0x8fe8f4*=0x9f63a0) returned 1 [0069.312] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0069.312] GetLastError () returned 0x0 [0069.312] CryptSetKeyParam (hKey=0x9f63a0, dwParam=0x4, pbData=0x2a4781c*=0x1, dwFlags=0x0) returned 1 [0069.312] GetLastError () returned 0x0 [0069.313] CryptSetKeyParam (hKey=0x9f63a0, dwParam=0x1, pbData=0x2a477e8, dwFlags=0x0) returned 1 [0069.313] GetLastError () returned 0x0 [0069.313] CryptEncrypt (in: hKey=0x9f63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2a4782c*, pdwDataLen=0x8fe9ac*=0x8f80, dwBufLen=0x8f80 | out: pbData=0x2a4782c*, pdwDataLen=0x8fe9ac*=0x8f80) returned 1 [0069.313] GetLastError () returned 0x0 [0069.313] CryptEncrypt (in: hKey=0x9f63a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2a507cc*, pdwDataLen=0x8fe9b4*=0x0, dwBufLen=0x10 | out: pbData=0x2a507cc*, pdwDataLen=0x8fe9b4*=0x10) returned 1 [0069.313] GetLastError () returned 0x0 [0069.313] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x74 [0069.313] GetLastError () returned 0x0 [0069.313] SetErrorMode (uMode=0x1) returned 0x0 [0069.313] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0069.315] GetLastError () returned 0xb7 [0069.316] GetFileType (hFile=0x444) returned 0x1 [0069.316] SetErrorMode (uMode=0x0) returned 0x1 [0069.316] GetFileType (hFile=0x444) returned 0x1 [0069.316] WriteFile (in: hFile=0x444, lpBuffer=0x2a4782c*, nNumberOfBytesToWrite=0x8f80, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2a4782c*, lpNumberOfBytesWritten=0x8fe958*=0x8f80, lpOverlapped=0x0) returned 1 [0069.317] GetLastError () returned 0xb7 [0069.317] CloseHandle (hObject=0x444) returned 1 [0069.319] GetLastError () returned 0xb7 [0069.319] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml.kFPQxPKemMuM7hDViu5onA==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml.kFPQxPKemMuM7hDViu5onA==.bwall", lpFilePart=0x0) returned 0x93 [0069.319] GetLastError () returned 0xb7 [0069.319] SetErrorMode (uMode=0x1) returned 0x0 [0069.319] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml.kFPQxPKemMuM7hDViu5onA==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml.kfpqxpkemmum7hdviu5ona==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0069.319] GetLastError () returned 0x0 [0069.319] GetFileType (hFile=0x444) returned 0x1 [0069.319] SetErrorMode (uMode=0x0) returned 0x1 [0069.319] GetFileType (hFile=0x444) returned 0x1 [0069.319] WriteFile (in: hFile=0x444, lpBuffer=0x2a4782c*, nNumberOfBytesToWrite=0x8f80, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2a4782c*, lpNumberOfBytesWritten=0x8fe958*=0x8f80, lpOverlapped=0x0) returned 1 [0069.327] GetLastError () returned 0x0 [0069.327] CloseHandle (hObject=0x444) returned 1 [0069.328] GetLastError () returned 0x0 [0069.328] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x74 [0069.328] GetLastError () returned 0x0 [0069.328] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml")) returned 1 [0069.329] GetLastError () returned 0x0 [0069.329] GetProcessWindowStation () returned 0x13c [0069.329] GetActiveWindow () returned 0x7002e [0069.329] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0069.329] GetCurrentThreadId () returned 0x540 [0069.330] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c441a, lParam=0x0) returned 1 [0069.330] IsWindowVisible (hWnd=0x7002e) returned 0 [0069.330] IsWindowVisible (hWnd=0x4020e) returned 0 [0069.330] IsWindowVisible (hWnd=0x60044) returned 0 [0069.330] IsWindowVisible (hWnd=0x2021a) returned 0 [0069.330] IsWindowVisible (hWnd=0x8004a) returned 0 [0069.330] GetActiveWindow () returned 0x7002e [0069.330] GetFocus () returned 0x7002e [0069.330] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0069.332] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0069.334] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0069.335] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0069.335] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0069.335] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0069.335] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0069.344] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x35020c) returned 0x1 [0069.344] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0069.345] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0069.650] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0069.658] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0069.659] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0069.659] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x35020c) returned 0x1 [0069.660] SetFocus (hWnd=0x7002e) returned 0x35020c [0069.662] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0069.663] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0069.663] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0069.664] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0069.664] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x35020c, lParam=0x0) returned 0x0 [0069.691] IsWindow (hWnd=0x7002e) returned 1 [0069.691] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0069.691] IsWindow (hWnd=0x7002e) returned 1 [0069.691] SetFocus (hWnd=0x7002e) returned 0x7002e [0069.691] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0069.691] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0069.691] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0069.692] GetProcessWindowStation () returned 0x13c [0069.692] GetActiveWindow () returned 0x7002e [0069.692] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0069.692] GetCurrentThreadId () returned 0x540 [0069.692] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c447a, lParam=0x0) returned 1 [0069.693] IsWindowVisible (hWnd=0x7002e) returned 0 [0069.693] IsWindowVisible (hWnd=0x4020e) returned 0 [0069.693] IsWindowVisible (hWnd=0x60044) returned 0 [0069.693] IsWindowVisible (hWnd=0x2021a) returned 0 [0069.693] IsWindowVisible (hWnd=0x8004a) returned 0 [0069.693] GetActiveWindow () returned 0x7002e [0069.693] GetFocus () returned 0x7002e [0069.693] MessageBoxW (hWnd=0x7002e, lpText="Hy5Nqj/nh341Dllfpk0mHQ==", lpCaption="", uType=0x0) returned 1 [0069.694] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0069.694] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0069.695] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0069.696] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0069.696] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0069.697] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0069.703] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x36020c) returned 0x1 [0069.704] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0069.704] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0070.038] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0070.046] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0070.046] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0070.047] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x36020c) returned 0x1 [0070.048] SetFocus (hWnd=0x7002e) returned 0x36020c [0070.050] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0070.051] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0070.051] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0070.051] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0070.051] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x36020c, lParam=0x0) returned 0x0 [0070.059] IsWindow (hWnd=0x7002e) returned 1 [0070.059] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0070.059] IsWindow (hWnd=0x7002e) returned 1 [0070.059] SetFocus (hWnd=0x7002e) returned 0x7002e [0070.059] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0070.059] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0070.059] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0070.059] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x81 [0070.059] GetLastError () returned 0x0 [0070.059] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", dwFileAttributes=0x80) returned 1 [0070.061] GetLastError () returned 0x0 [0070.061] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x81 [0070.061] GetLastError () returned 0x0 [0070.061] SetErrorMode (uMode=0x1) returned 0x0 [0070.061] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0070.061] GetLastError () returned 0x0 [0070.061] GetFileType (hFile=0x444) returned 0x1 [0070.061] SetErrorMode (uMode=0x0) returned 0x1 [0070.061] GetFileType (hFile=0x444) returned 0x1 [0070.061] GetFileSize (in: hFile=0x444, lpFileSizeHigh=0x8fe9a4 | out: lpFileSizeHigh=0x8fe9a4*=0x0) returned 0x8f8e [0070.061] GetLastError () returned 0x0 [0070.062] ReadFile (in: hFile=0x444, lpBuffer=0x2a55dac, nNumberOfBytesToRead=0x8f8e, lpNumberOfBytesRead=0x8fe94c, lpOverlapped=0x0 | out: lpBuffer=0x2a55dac*, lpNumberOfBytesRead=0x8fe94c*=0x8f8e, lpOverlapped=0x0) returned 1 [0070.064] GetLastError () returned 0x0 [0070.064] CloseHandle (hObject=0x444) returned 1 [0070.064] GetLastError () returned 0x0 [0070.064] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0070.064] GetLastError () returned 0x0 [0070.065] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8f4 | out: phKey=0x8fe8f4*=0x9f61e0) returned 1 [0070.065] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0070.065] GetLastError () returned 0x0 [0070.065] CryptSetKeyParam (hKey=0x9f61e0, dwParam=0x4, pbData=0x2a5edb0*=0x1, dwFlags=0x0) returned 1 [0070.065] GetLastError () returned 0x0 [0070.065] CryptSetKeyParam (hKey=0x9f61e0, dwParam=0x1, pbData=0x2a5ed7c, dwFlags=0x0) returned 1 [0070.065] GetLastError () returned 0x0 [0070.065] CryptEncrypt (in: hKey=0x9f61e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2a5edc0*, pdwDataLen=0x8fe9ac*=0x8f90, dwBufLen=0x8f90 | out: pbData=0x2a5edc0*, pdwDataLen=0x8fe9ac*=0x8f90) returned 1 [0070.065] GetLastError () returned 0x0 [0070.065] CryptEncrypt (in: hKey=0x9f61e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2a67d70*, pdwDataLen=0x8fe9b4*=0x0, dwBufLen=0x10 | out: pbData=0x2a67d70*, pdwDataLen=0x8fe9b4*=0x10) returned 1 [0070.065] GetLastError () returned 0x0 [0070.065] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x81 [0070.065] GetLastError () returned 0x0 [0070.065] SetErrorMode (uMode=0x1) returned 0x0 [0070.066] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0070.067] GetLastError () returned 0xb7 [0070.067] GetFileType (hFile=0x444) returned 0x1 [0070.067] SetErrorMode (uMode=0x0) returned 0x1 [0070.067] GetFileType (hFile=0x444) returned 0x1 [0070.067] WriteFile (in: hFile=0x444, lpBuffer=0x2a5edc0*, nNumberOfBytesToWrite=0x8f90, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2a5edc0*, lpNumberOfBytesWritten=0x8fe958*=0x8f90, lpOverlapped=0x0) returned 1 [0070.068] GetLastError () returned 0xb7 [0070.068] CloseHandle (hObject=0x444) returned 1 [0070.070] GetLastError () returned 0xb7 [0070.070] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml.Hy5Nqj#nh341Dllfpk0mHQ==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml.Hy5Nqj#nh341Dllfpk0mHQ==.bwall", lpFilePart=0x0) returned 0xa0 [0070.070] GetLastError () returned 0xb7 [0070.070] SetErrorMode (uMode=0x1) returned 0x0 [0070.070] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml.Hy5Nqj#nh341Dllfpk0mHQ==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml.hy5nqj#nh341dllfpk0mhq==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0070.075] GetLastError () returned 0x0 [0070.075] GetFileType (hFile=0x444) returned 0x1 [0070.075] SetErrorMode (uMode=0x0) returned 0x1 [0070.075] GetFileType (hFile=0x444) returned 0x1 [0070.075] WriteFile (in: hFile=0x444, lpBuffer=0x2a5edc0*, nNumberOfBytesToWrite=0x8f90, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2a5edc0*, lpNumberOfBytesWritten=0x8fe958*=0x8f90, lpOverlapped=0x0) returned 1 [0070.076] GetLastError () returned 0x0 [0070.076] CloseHandle (hObject=0x444) returned 1 [0070.077] GetLastError () returned 0x0 [0070.077] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x81 [0070.077] GetLastError () returned 0x0 [0070.077] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml")) returned 1 [0070.079] GetLastError () returned 0x0 [0070.079] GetProcessWindowStation () returned 0x13c [0070.079] GetActiveWindow () returned 0x7002e [0070.079] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0070.079] GetCurrentThreadId () returned 0x540 [0070.080] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c426a, lParam=0x0) returned 1 [0070.080] IsWindowVisible (hWnd=0x7002e) returned 0 [0070.080] IsWindowVisible (hWnd=0x4020e) returned 0 [0070.080] IsWindowVisible (hWnd=0x60044) returned 0 [0070.080] IsWindowVisible (hWnd=0x2021a) returned 0 [0070.080] IsWindowVisible (hWnd=0x8004a) returned 0 [0070.080] GetActiveWindow () returned 0x7002e [0070.080] GetFocus () returned 0x7002e [0070.080] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0070.081] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0070.082] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0070.082] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0070.083] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0070.083] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0070.083] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0070.187] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x37020c) returned 0x1 [0070.188] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0070.188] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0070.298] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0070.305] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0070.308] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0070.308] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x37020c) returned 0x1 [0070.310] SetFocus (hWnd=0x7002e) returned 0x37020c [0070.311] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0070.313] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0070.313] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0070.313] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0070.313] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x37020c, lParam=0x0) returned 0x0 [0070.318] IsWindow (hWnd=0x7002e) returned 1 [0070.318] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0070.319] IsWindow (hWnd=0x7002e) returned 1 [0070.319] SetFocus (hWnd=0x7002e) returned 0x7002e [0070.319] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0070.319] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0070.319] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0070.319] GetProcessWindowStation () returned 0x13c [0070.319] GetActiveWindow () returned 0x7002e [0070.319] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0070.319] GetCurrentThreadId () returned 0x540 [0070.320] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c444a, lParam=0x0) returned 1 [0070.320] IsWindowVisible (hWnd=0x7002e) returned 0 [0070.320] IsWindowVisible (hWnd=0x4020e) returned 0 [0070.320] IsWindowVisible (hWnd=0x60044) returned 0 [0070.320] IsWindowVisible (hWnd=0x2021a) returned 0 [0070.320] IsWindowVisible (hWnd=0x8004a) returned 0 [0070.320] GetActiveWindow () returned 0x7002e [0070.320] GetFocus () returned 0x7002e [0070.320] MessageBoxW (hWnd=0x7002e, lpText="UCtjL/miOowWtzeFHpm7vQ==", lpCaption="", uType=0x0) returned 1 [0070.321] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0070.322] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0070.323] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0070.323] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0070.323] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0070.323] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0070.331] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x38020c) returned 0x1 [0070.332] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0070.332] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0070.666] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0070.676] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0070.676] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0070.676] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x38020c) returned 0x1 [0070.678] SetFocus (hWnd=0x7002e) returned 0x38020c [0070.679] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0070.681] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0070.681] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0070.681] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0070.682] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x38020c, lParam=0x0) returned 0x0 [0070.686] IsWindow (hWnd=0x7002e) returned 1 [0070.686] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0070.686] IsWindow (hWnd=0x7002e) returned 1 [0070.686] SetFocus (hWnd=0x7002e) returned 0x7002e [0070.686] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0070.686] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0070.686] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0070.686] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x75 [0070.686] GetLastError () returned 0x0 [0070.686] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml", dwFileAttributes=0x80) returned 1 [0070.688] GetLastError () returned 0x0 [0070.688] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x75 [0070.688] GetLastError () returned 0x0 [0070.688] SetErrorMode (uMode=0x1) returned 0x0 [0070.689] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0070.689] GetLastError () returned 0x0 [0070.689] GetFileType (hFile=0x444) returned 0x1 [0070.689] SetErrorMode (uMode=0x0) returned 0x1 [0070.689] GetFileType (hFile=0x444) returned 0x1 [0070.689] GetFileSize (in: hFile=0x444, lpFileSizeHigh=0x8fe9a4 | out: lpFileSizeHigh=0x8fe9a4*=0x0) returned 0x180e [0070.689] GetLastError () returned 0x0 [0070.689] ReadFile (in: hFile=0x444, lpBuffer=0x2a6d3e4, nNumberOfBytesToRead=0x180e, lpNumberOfBytesRead=0x8fe94c, lpOverlapped=0x0 | out: lpBuffer=0x2a6d3e4*, lpNumberOfBytesRead=0x8fe94c*=0x180e, lpOverlapped=0x0) returned 1 [0070.690] GetLastError () returned 0x0 [0070.691] CloseHandle (hObject=0x444) returned 1 [0070.691] GetLastError () returned 0x0 [0070.691] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0070.691] GetLastError () returned 0x0 [0070.691] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8f4 | out: phKey=0x8fe8f4*=0x9f60a0) returned 1 [0070.691] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0070.691] GetLastError () returned 0x0 [0070.691] CryptSetKeyParam (hKey=0x9f60a0, dwParam=0x4, pbData=0x2a6ec68*=0x1, dwFlags=0x0) returned 1 [0070.691] GetLastError () returned 0x0 [0070.691] CryptSetKeyParam (hKey=0x9f60a0, dwParam=0x1, pbData=0x2a6ec34, dwFlags=0x0) returned 1 [0070.691] GetLastError () returned 0x0 [0070.691] CryptEncrypt (in: hKey=0x9f60a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2a6ec78*, pdwDataLen=0x8fe9ac*=0x1810, dwBufLen=0x1810 | out: pbData=0x2a6ec78*, pdwDataLen=0x8fe9ac*=0x1810) returned 1 [0070.691] GetLastError () returned 0x0 [0070.691] CryptEncrypt (in: hKey=0x9f60a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2a704a8*, pdwDataLen=0x8fe9b4*=0x0, dwBufLen=0x10 | out: pbData=0x2a704a8*, pdwDataLen=0x8fe9b4*=0x10) returned 1 [0070.691] GetLastError () returned 0x0 [0070.691] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x75 [0070.692] GetLastError () returned 0x0 [0070.692] SetErrorMode (uMode=0x1) returned 0x0 [0070.692] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0070.693] GetLastError () returned 0xb7 [0070.693] GetFileType (hFile=0x444) returned 0x1 [0070.693] SetErrorMode (uMode=0x0) returned 0x1 [0070.693] GetFileType (hFile=0x444) returned 0x1 [0070.693] WriteFile (in: hFile=0x444, lpBuffer=0x2a6ec78*, nNumberOfBytesToWrite=0x1810, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2a6ec78*, lpNumberOfBytesWritten=0x8fe958*=0x1810, lpOverlapped=0x0) returned 1 [0070.694] GetLastError () returned 0xb7 [0070.694] CloseHandle (hObject=0x444) returned 1 [0070.695] GetLastError () returned 0xb7 [0070.695] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml.UCtjL#miOowWtzeFHpm7vQ==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml.UCtjL#miOowWtzeFHpm7vQ==.bwall", lpFilePart=0x0) returned 0x94 [0070.695] GetLastError () returned 0xb7 [0070.695] SetErrorMode (uMode=0x1) returned 0x0 [0070.701] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml.UCtjL#miOowWtzeFHpm7vQ==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml.uctjl#mioowwtzefhpm7vq==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0070.701] GetLastError () returned 0x0 [0070.701] GetFileType (hFile=0x444) returned 0x1 [0070.702] SetErrorMode (uMode=0x0) returned 0x1 [0070.702] GetFileType (hFile=0x444) returned 0x1 [0070.702] WriteFile (in: hFile=0x444, lpBuffer=0x2a6ec78*, nNumberOfBytesToWrite=0x1810, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2a6ec78*, lpNumberOfBytesWritten=0x8fe958*=0x1810, lpOverlapped=0x0) returned 1 [0070.703] GetLastError () returned 0x0 [0070.703] CloseHandle (hObject=0x444) returned 1 [0070.703] GetLastError () returned 0x0 [0070.703] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x75 [0070.703] GetLastError () returned 0x0 [0070.703] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml")) returned 1 [0070.704] GetLastError () returned 0x0 [0070.704] GetProcessWindowStation () returned 0x13c [0070.705] GetActiveWindow () returned 0x7002e [0070.705] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0070.705] GetCurrentThreadId () returned 0x540 [0070.705] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c44da, lParam=0x0) returned 1 [0070.705] IsWindowVisible (hWnd=0x7002e) returned 0 [0070.705] IsWindowVisible (hWnd=0x4020e) returned 0 [0070.705] IsWindowVisible (hWnd=0x60044) returned 0 [0070.705] IsWindowVisible (hWnd=0x2021a) returned 0 [0070.706] IsWindowVisible (hWnd=0x8004a) returned 0 [0070.706] GetActiveWindow () returned 0x7002e [0070.706] GetFocus () returned 0x7002e [0070.706] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0070.707] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0070.707] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0070.708] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0070.708] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0070.708] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0070.708] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0070.715] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x39020c) returned 0x1 [0070.716] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0070.716] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0070.902] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0070.909] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0070.909] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0070.909] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x39020c) returned 0x1 [0070.910] SetFocus (hWnd=0x7002e) returned 0x39020c [0070.912] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0070.913] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0070.913] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0070.914] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0070.914] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x39020c, lParam=0x0) returned 0x0 [0070.921] IsWindow (hWnd=0x7002e) returned 1 [0070.921] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0070.921] IsWindow (hWnd=0x7002e) returned 1 [0070.921] SetFocus (hWnd=0x7002e) returned 0x7002e [0070.921] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0070.921] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0070.921] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0070.921] GetProcessWindowStation () returned 0x13c [0070.921] GetActiveWindow () returned 0x7002e [0070.921] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0070.921] GetCurrentThreadId () returned 0x540 [0070.922] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c42ca, lParam=0x0) returned 1 [0070.922] IsWindowVisible (hWnd=0x7002e) returned 0 [0070.922] IsWindowVisible (hWnd=0x4020e) returned 0 [0070.922] IsWindowVisible (hWnd=0x60044) returned 0 [0070.922] IsWindowVisible (hWnd=0x2021a) returned 0 [0070.922] IsWindowVisible (hWnd=0x8004a) returned 0 [0070.922] GetActiveWindow () returned 0x7002e [0070.922] GetFocus () returned 0x7002e [0070.922] MessageBoxW (hWnd=0x7002e, lpText="r1d9h1tx/xfizLncdH0cnQ==", lpCaption="", uType=0x0) returned 1 [0070.923] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0070.923] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0070.924] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0070.924] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0070.925] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0070.925] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0070.932] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x3a020c) returned 0x1 [0070.932] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0070.933] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0071.110] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0071.119] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0071.119] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0071.119] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x3a020c) returned 0x1 [0071.120] SetFocus (hWnd=0x7002e) returned 0x3a020c [0071.122] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0071.123] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0071.123] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0071.124] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0071.124] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x3a020c, lParam=0x0) returned 0x0 [0071.128] IsWindow (hWnd=0x7002e) returned 1 [0071.128] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0071.128] IsWindow (hWnd=0x7002e) returned 1 [0071.128] SetFocus (hWnd=0x7002e) returned 0x7002e [0071.129] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0071.129] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0071.129] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0071.129] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7d [0071.129] GetLastError () returned 0x0 [0071.129] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", dwFileAttributes=0x80) returned 1 [0071.130] GetLastError () returned 0x0 [0071.130] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7d [0071.130] GetLastError () returned 0x0 [0071.130] SetErrorMode (uMode=0x1) returned 0x0 [0071.130] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0071.130] GetLastError () returned 0x0 [0071.130] GetFileType (hFile=0x444) returned 0x1 [0071.130] SetErrorMode (uMode=0x0) returned 0x1 [0071.130] GetFileType (hFile=0x444) returned 0x1 [0071.130] GetFileSize (in: hFile=0x444, lpFileSizeHigh=0x8fe9a4 | out: lpFileSizeHigh=0x8fe9a4*=0x0) returned 0x1979c [0071.130] GetLastError () returned 0x0 [0071.131] ReadFile (in: hFile=0x444, lpBuffer=0x3a8bb88, nNumberOfBytesToRead=0x1979c, lpNumberOfBytesRead=0x8fe94c, lpOverlapped=0x0 | out: lpBuffer=0x3a8bb88*, lpNumberOfBytesRead=0x8fe94c*=0x1979c, lpOverlapped=0x0) returned 1 [0071.148] GetLastError () returned 0x0 [0071.148] CloseHandle (hObject=0x444) returned 1 [0071.148] GetLastError () returned 0x0 [0071.149] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0071.149] GetLastError () returned 0x0 [0071.149] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8f4 | out: phKey=0x8fe8f4*=0x9f6120) returned 1 [0071.149] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0071.149] GetLastError () returned 0x0 [0071.149] CryptSetKeyParam (hKey=0x9f6120, dwParam=0x4, pbData=0x2a75b24*=0x1, dwFlags=0x0) returned 1 [0071.150] GetLastError () returned 0x0 [0071.150] CryptSetKeyParam (hKey=0x9f6120, dwParam=0x1, pbData=0x2a75af0, dwFlags=0x0) returned 1 [0071.150] GetLastError () returned 0x0 [0071.152] CryptEncrypt (in: hKey=0x9f6120, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3aa5340*, pdwDataLen=0x8fe9ac*=0x197a0, dwBufLen=0x197a0 | out: pbData=0x3aa5340*, pdwDataLen=0x8fe9ac*=0x197a0) returned 1 [0071.152] GetLastError () returned 0x0 [0071.152] CryptEncrypt (in: hKey=0x9f6120, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2a75b48*, pdwDataLen=0x8fe9b4*=0x0, dwBufLen=0x10 | out: pbData=0x2a75b48*, pdwDataLen=0x8fe9b4*=0x10) returned 1 [0071.152] GetLastError () returned 0x0 [0071.153] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7d [0071.153] GetLastError () returned 0x0 [0071.153] SetErrorMode (uMode=0x1) returned 0x0 [0071.153] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0071.154] GetLastError () returned 0xb7 [0071.154] GetFileType (hFile=0x444) returned 0x1 [0071.154] SetErrorMode (uMode=0x0) returned 0x1 [0071.154] GetFileType (hFile=0x444) returned 0x1 [0071.155] WriteFile (in: hFile=0x444, lpBuffer=0x3aa5340*, nNumberOfBytesToWrite=0x197a0, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x3aa5340*, lpNumberOfBytesWritten=0x8fe958*=0x197a0, lpOverlapped=0x0) returned 1 [0071.157] GetLastError () returned 0xb7 [0071.157] CloseHandle (hObject=0x444) returned 1 [0071.160] GetLastError () returned 0xb7 [0071.160] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.r1d9h1tx#xfizLncdH0cnQ==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.r1d9h1tx#xfizLncdH0cnQ==.bwall", lpFilePart=0x0) returned 0x9c [0071.160] GetLastError () returned 0xb7 [0071.160] SetErrorMode (uMode=0x1) returned 0x0 [0071.160] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.r1d9h1tx#xfizLncdH0cnQ==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml.r1d9h1tx#xfizlncdh0cnq==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0071.160] GetLastError () returned 0x0 [0071.160] GetFileType (hFile=0x444) returned 0x1 [0071.160] SetErrorMode (uMode=0x0) returned 0x1 [0071.160] GetFileType (hFile=0x444) returned 0x1 [0071.160] WriteFile (in: hFile=0x444, lpBuffer=0x3aa5340*, nNumberOfBytesToWrite=0x197a0, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x3aa5340*, lpNumberOfBytesWritten=0x8fe958*=0x197a0, lpOverlapped=0x0) returned 1 [0071.163] GetLastError () returned 0x0 [0071.163] CloseHandle (hObject=0x444) returned 1 [0071.167] GetLastError () returned 0x0 [0071.167] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7d [0071.167] GetLastError () returned 0x0 [0071.167] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml")) returned 1 [0071.169] GetLastError () returned 0x0 [0071.173] GetProcessWindowStation () returned 0x13c [0071.173] GetActiveWindow () returned 0x7002e [0071.174] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0071.174] GetCurrentThreadId () returned 0x540 [0071.174] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c435a, lParam=0x0) returned 1 [0071.175] IsWindowVisible (hWnd=0x7002e) returned 0 [0071.175] IsWindowVisible (hWnd=0x4020e) returned 0 [0071.175] IsWindowVisible (hWnd=0x60044) returned 0 [0071.175] IsWindowVisible (hWnd=0x2021a) returned 0 [0071.175] IsWindowVisible (hWnd=0x8004a) returned 0 [0071.175] GetActiveWindow () returned 0x7002e [0071.175] GetFocus () returned 0x7002e [0071.175] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0071.176] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0071.177] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0071.178] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0071.178] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0071.178] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0071.178] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0071.185] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x3b020c) returned 0x1 [0071.186] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0071.186] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0071.343] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0071.351] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0071.351] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0071.351] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x3b020c) returned 0x1 [0071.356] SetFocus (hWnd=0x7002e) returned 0x3b020c [0071.358] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0071.359] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0071.359] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0071.359] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0071.360] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x3b020c, lParam=0x0) returned 0x0 [0071.365] IsWindow (hWnd=0x7002e) returned 1 [0071.365] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0071.365] IsWindow (hWnd=0x7002e) returned 1 [0071.365] SetFocus (hWnd=0x7002e) returned 0x7002e [0071.365] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0071.365] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0071.365] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0071.366] GetProcessWindowStation () returned 0x13c [0071.366] GetActiveWindow () returned 0x7002e [0071.366] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0071.366] GetCurrentThreadId () returned 0x540 [0071.366] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c456a, lParam=0x0) returned 1 [0071.366] IsWindowVisible (hWnd=0x7002e) returned 0 [0071.366] IsWindowVisible (hWnd=0x4020e) returned 0 [0071.367] IsWindowVisible (hWnd=0x60044) returned 0 [0071.367] IsWindowVisible (hWnd=0x2021a) returned 0 [0071.367] IsWindowVisible (hWnd=0x8004a) returned 0 [0071.367] GetActiveWindow () returned 0x7002e [0071.367] GetFocus () returned 0x7002e [0071.367] MessageBoxW (hWnd=0x7002e, lpText="/MEA/7RdBVdZaxHPgVOEGw==", lpCaption="", uType=0x0) returned 1 [0071.368] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0071.369] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0071.369] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0071.370] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0071.370] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0071.370] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0071.377] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x3c020c) returned 0x1 [0071.378] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0071.378] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0071.655] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0071.663] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0071.663] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0071.663] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x3c020c) returned 0x1 [0071.668] SetFocus (hWnd=0x7002e) returned 0x3c020c [0071.670] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0071.671] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0071.671] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0071.672] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0071.672] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x3c020c, lParam=0x0) returned 0x0 [0071.676] IsWindow (hWnd=0x7002e) returned 1 [0071.676] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0071.676] IsWindow (hWnd=0x7002e) returned 1 [0071.676] SetFocus (hWnd=0x7002e) returned 0x7002e [0071.676] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0071.676] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0071.676] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0071.676] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x73 [0071.676] GetLastError () returned 0x0 [0071.677] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml", dwFileAttributes=0x80) returned 1 [0071.677] GetLastError () returned 0x0 [0071.677] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x73 [0071.677] GetLastError () returned 0x0 [0071.678] SetErrorMode (uMode=0x1) returned 0x0 [0071.678] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0071.678] GetLastError () returned 0x0 [0071.678] GetFileType (hFile=0x444) returned 0x1 [0071.678] SetErrorMode (uMode=0x0) returned 0x1 [0071.678] GetFileType (hFile=0x444) returned 0x1 [0071.678] GetFileSize (in: hFile=0x444, lpFileSizeHigh=0x8fe9a4 | out: lpFileSizeHigh=0x8fe9a4*=0x0) returned 0x5b94 [0071.678] GetLastError () returned 0x0 [0071.678] ReadFile (in: hFile=0x444, lpBuffer=0x2a7b180, nNumberOfBytesToRead=0x5b94, lpNumberOfBytesRead=0x8fe94c, lpOverlapped=0x0 | out: lpBuffer=0x2a7b180*, lpNumberOfBytesRead=0x8fe94c*=0x5b94, lpOverlapped=0x0) returned 1 [0071.680] GetLastError () returned 0x0 [0071.680] CloseHandle (hObject=0x444) returned 1 [0071.680] GetLastError () returned 0x0 [0071.680] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0071.680] GetLastError () returned 0x0 [0071.680] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8f4 | out: phKey=0x8fe8f4*=0x9f6560) returned 1 [0071.681] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0071.681] GetLastError () returned 0x0 [0071.681] CryptSetKeyParam (hKey=0x9f6560, dwParam=0x4, pbData=0x2a80d88*=0x1, dwFlags=0x0) returned 1 [0071.681] GetLastError () returned 0x0 [0071.681] CryptSetKeyParam (hKey=0x9f6560, dwParam=0x1, pbData=0x2a80d54, dwFlags=0x0) returned 1 [0071.681] GetLastError () returned 0x0 [0071.681] CryptEncrypt (in: hKey=0x9f6560, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2a80d98*, pdwDataLen=0x8fe9ac*=0x5ba0, dwBufLen=0x5ba0 | out: pbData=0x2a80d98*, pdwDataLen=0x8fe9ac*=0x5ba0) returned 1 [0071.681] GetLastError () returned 0x0 [0071.681] CryptEncrypt (in: hKey=0x9f6560, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2a86958*, pdwDataLen=0x8fe9b4*=0x0, dwBufLen=0x10 | out: pbData=0x2a86958*, pdwDataLen=0x8fe9b4*=0x10) returned 1 [0071.681] GetLastError () returned 0x0 [0071.681] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x73 [0071.681] GetLastError () returned 0x0 [0071.681] SetErrorMode (uMode=0x1) returned 0x0 [0071.681] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0071.682] GetLastError () returned 0xb7 [0071.682] GetFileType (hFile=0x444) returned 0x1 [0071.682] SetErrorMode (uMode=0x0) returned 0x1 [0071.683] GetFileType (hFile=0x444) returned 0x1 [0071.683] WriteFile (in: hFile=0x444, lpBuffer=0x2a80d98*, nNumberOfBytesToWrite=0x5ba0, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2a80d98*, lpNumberOfBytesWritten=0x8fe958*=0x5ba0, lpOverlapped=0x0) returned 1 [0071.684] GetLastError () returned 0xb7 [0071.684] CloseHandle (hObject=0x444) returned 1 [0071.685] GetLastError () returned 0xb7 [0071.685] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml.#MEA#7RdBVdZaxHPgVOEGw==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml.#MEA#7RdBVdZaxHPgVOEGw==.bwall", lpFilePart=0x0) returned 0x92 [0071.685] GetLastError () returned 0xb7 [0071.685] SetErrorMode (uMode=0x1) returned 0x0 [0071.686] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml.#MEA#7RdBVdZaxHPgVOEGw==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml.#mea#7rdbvdzaxhpgvoegw==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0071.686] GetLastError () returned 0x0 [0071.686] GetFileType (hFile=0x444) returned 0x1 [0071.686] SetErrorMode (uMode=0x0) returned 0x1 [0071.686] GetFileType (hFile=0x444) returned 0x1 [0071.686] WriteFile (in: hFile=0x444, lpBuffer=0x2a80d98*, nNumberOfBytesToWrite=0x5ba0, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2a80d98*, lpNumberOfBytesWritten=0x8fe958*=0x5ba0, lpOverlapped=0x0) returned 1 [0071.687] GetLastError () returned 0x0 [0071.687] CloseHandle (hObject=0x444) returned 1 [0071.688] GetLastError () returned 0x0 [0071.688] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x73 [0071.688] GetLastError () returned 0x0 [0071.688] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml")) returned 1 [0071.689] GetLastError () returned 0x0 [0071.689] GetProcessWindowStation () returned 0x13c [0071.689] GetActiveWindow () returned 0x7002e [0071.689] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0071.690] GetCurrentThreadId () returned 0x540 [0071.690] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c438a, lParam=0x0) returned 1 [0071.690] IsWindowVisible (hWnd=0x7002e) returned 0 [0071.690] IsWindowVisible (hWnd=0x4020e) returned 0 [0071.690] IsWindowVisible (hWnd=0x60044) returned 0 [0071.690] IsWindowVisible (hWnd=0x2021a) returned 0 [0071.690] IsWindowVisible (hWnd=0x8004a) returned 0 [0071.690] GetActiveWindow () returned 0x7002e [0071.691] GetFocus () returned 0x7002e [0071.691] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0071.691] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0071.692] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0071.693] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0071.693] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0071.693] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0071.693] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0071.701] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x3d020c) returned 0x1 [0071.702] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0071.702] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0071.800] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0071.812] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0071.812] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0071.813] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x3d020c) returned 0x1 [0071.814] SetFocus (hWnd=0x7002e) returned 0x3d020c [0071.816] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0071.817] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0071.817] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0071.818] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0071.818] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x3d020c, lParam=0x0) returned 0x0 [0071.824] IsWindow (hWnd=0x7002e) returned 1 [0071.824] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0071.824] IsWindow (hWnd=0x7002e) returned 1 [0071.824] SetFocus (hWnd=0x7002e) returned 0x7002e [0071.824] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0071.824] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0071.824] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0071.824] GetProcessWindowStation () returned 0x13c [0071.824] GetActiveWindow () returned 0x7002e [0071.824] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0071.824] GetCurrentThreadId () returned 0x540 [0071.825] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c450a, lParam=0x0) returned 1 [0071.825] IsWindowVisible (hWnd=0x7002e) returned 0 [0071.825] IsWindowVisible (hWnd=0x4020e) returned 0 [0071.825] IsWindowVisible (hWnd=0x60044) returned 0 [0071.825] IsWindowVisible (hWnd=0x2021a) returned 0 [0071.825] IsWindowVisible (hWnd=0x8004a) returned 0 [0071.825] GetActiveWindow () returned 0x7002e [0071.825] GetFocus () returned 0x7002e [0071.825] MessageBoxW (hWnd=0x7002e, lpText="KjG+a0QcWnj1TMFH1VmKCg==", lpCaption="", uType=0x0) returned 1 [0071.826] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0071.827] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0071.828] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0071.828] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0071.828] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0071.828] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0071.835] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x3e020c) returned 0x1 [0071.836] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0071.836] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0072.011] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0072.020] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0072.020] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0072.021] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x3e020c) returned 0x1 [0072.022] SetFocus (hWnd=0x7002e) returned 0x3e020c [0072.028] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0072.029] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0072.029] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0072.030] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0072.030] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x3e020c, lParam=0x0) returned 0x0 [0072.035] IsWindow (hWnd=0x7002e) returned 1 [0072.035] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0072.035] IsWindow (hWnd=0x7002e) returned 1 [0072.035] SetFocus (hWnd=0x7002e) returned 0x7002e [0072.035] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0072.035] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0072.035] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0072.035] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x77 [0072.035] GetLastError () returned 0x0 [0072.035] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml", dwFileAttributes=0x80) returned 1 [0072.037] GetLastError () returned 0x0 [0072.037] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x77 [0072.037] GetLastError () returned 0x0 [0072.037] SetErrorMode (uMode=0x1) returned 0x0 [0072.037] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32mui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0072.037] GetLastError () returned 0x0 [0072.037] GetFileType (hFile=0x444) returned 0x1 [0072.037] SetErrorMode (uMode=0x0) returned 0x1 [0072.037] GetFileType (hFile=0x444) returned 0x1 [0072.038] GetFileSize (in: hFile=0x444, lpFileSizeHigh=0x8fe9a4 | out: lpFileSizeHigh=0x8fe9a4*=0x0) returned 0x6b4a [0072.038] GetLastError () returned 0x0 [0072.038] ReadFile (in: hFile=0x444, lpBuffer=0x2a8bf30, nNumberOfBytesToRead=0x6b4a, lpNumberOfBytesRead=0x8fe94c, lpOverlapped=0x0 | out: lpBuffer=0x2a8bf30*, lpNumberOfBytesRead=0x8fe94c*=0x6b4a, lpOverlapped=0x0) returned 1 [0072.039] GetLastError () returned 0x0 [0072.039] CloseHandle (hObject=0x444) returned 1 [0072.039] GetLastError () returned 0x0 [0072.039] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0072.040] GetLastError () returned 0x0 [0072.040] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8f4 | out: phKey=0x8fe8f4*=0x9f65a0) returned 1 [0072.040] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0072.040] GetLastError () returned 0x0 [0072.040] CryptSetKeyParam (hKey=0x9f65a0, dwParam=0x4, pbData=0x2a92af0*=0x1, dwFlags=0x0) returned 1 [0072.040] GetLastError () returned 0x0 [0072.040] CryptSetKeyParam (hKey=0x9f65a0, dwParam=0x1, pbData=0x2a92abc, dwFlags=0x0) returned 1 [0072.040] GetLastError () returned 0x0 [0072.040] CryptEncrypt (in: hKey=0x9f65a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2a92b00*, pdwDataLen=0x8fe9ac*=0x6b50, dwBufLen=0x6b50 | out: pbData=0x2a92b00*, pdwDataLen=0x8fe9ac*=0x6b50) returned 1 [0072.040] GetLastError () returned 0x0 [0072.040] CryptEncrypt (in: hKey=0x9f65a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2a99670*, pdwDataLen=0x8fe9b4*=0x0, dwBufLen=0x10 | out: pbData=0x2a99670*, pdwDataLen=0x8fe9b4*=0x10) returned 1 [0072.040] GetLastError () returned 0x0 [0072.040] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x77 [0072.040] GetLastError () returned 0x0 [0072.040] SetErrorMode (uMode=0x1) returned 0x0 [0072.041] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32mui.msi.16.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0072.042] GetLastError () returned 0xb7 [0072.042] GetFileType (hFile=0x444) returned 0x1 [0072.042] SetErrorMode (uMode=0x0) returned 0x1 [0072.042] GetFileType (hFile=0x444) returned 0x1 [0072.042] WriteFile (in: hFile=0x444, lpBuffer=0x2a92b00*, nNumberOfBytesToWrite=0x6b50, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2a92b00*, lpNumberOfBytesWritten=0x8fe958*=0x6b50, lpOverlapped=0x0) returned 1 [0072.043] GetLastError () returned 0xb7 [0072.043] CloseHandle (hObject=0x444) returned 1 [0072.044] GetLastError () returned 0xb7 [0072.044] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml.KjG+a0QcWnj1TMFH1VmKCg==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml.KjG+a0QcWnj1TMFH1VmKCg==.bwall", lpFilePart=0x0) returned 0x96 [0072.045] GetLastError () returned 0xb7 [0072.045] SetErrorMode (uMode=0x1) returned 0x0 [0072.045] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml.KjG+a0QcWnj1TMFH1VmKCg==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32mui.msi.16.en-us.xml.kjg+a0qcwnj1tmfh1vmkcg==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0072.045] GetLastError () returned 0x0 [0072.045] GetFileType (hFile=0x444) returned 0x1 [0072.045] SetErrorMode (uMode=0x0) returned 0x1 [0072.045] GetFileType (hFile=0x444) returned 0x1 [0072.045] WriteFile (in: hFile=0x444, lpBuffer=0x2a92b00*, nNumberOfBytesToWrite=0x6b50, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2a92b00*, lpNumberOfBytesWritten=0x8fe958*=0x6b50, lpOverlapped=0x0) returned 1 [0072.047] GetLastError () returned 0x0 [0072.047] CloseHandle (hObject=0x444) returned 1 [0072.047] GetLastError () returned 0x0 [0072.047] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x77 [0072.048] GetLastError () returned 0x0 [0072.048] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32mui.msi.16.en-us.xml")) returned 1 [0072.049] GetLastError () returned 0x0 [0072.049] GetProcessWindowStation () returned 0x13c [0072.049] GetActiveWindow () returned 0x7002e [0072.049] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0072.049] GetCurrentThreadId () returned 0x540 [0072.049] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c453a, lParam=0x0) returned 1 [0072.050] IsWindowVisible (hWnd=0x7002e) returned 0 [0072.050] IsWindowVisible (hWnd=0x4020e) returned 0 [0072.050] IsWindowVisible (hWnd=0x60044) returned 0 [0072.050] IsWindowVisible (hWnd=0x2021a) returned 0 [0072.050] IsWindowVisible (hWnd=0x8004a) returned 0 [0072.050] GetActiveWindow () returned 0x7002e [0072.050] GetFocus () returned 0x7002e [0072.050] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0072.051] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0072.052] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0072.052] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0072.053] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0072.053] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0072.063] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0072.074] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x3f020c) returned 0x1 [0072.074] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0072.075] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0072.207] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0072.218] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0072.218] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0072.218] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x3f020c) returned 0x1 [0072.220] SetFocus (hWnd=0x7002e) returned 0x3f020c [0072.222] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0072.223] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0072.223] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0072.223] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0072.224] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x3f020c, lParam=0x0) returned 0x0 [0072.231] IsWindow (hWnd=0x7002e) returned 1 [0072.231] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0072.231] IsWindow (hWnd=0x7002e) returned 1 [0072.231] SetFocus (hWnd=0x7002e) returned 0x7002e [0072.231] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0072.231] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0072.231] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0072.231] GetProcessWindowStation () returned 0x13c [0072.231] GetActiveWindow () returned 0x7002e [0072.231] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0072.231] GetCurrentThreadId () returned 0x540 [0072.232] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c41da, lParam=0x0) returned 1 [0072.232] IsWindowVisible (hWnd=0x7002e) returned 0 [0072.232] IsWindowVisible (hWnd=0x4020e) returned 0 [0072.232] IsWindowVisible (hWnd=0x60044) returned 0 [0072.232] IsWindowVisible (hWnd=0x2021a) returned 0 [0072.232] IsWindowVisible (hWnd=0x8004a) returned 0 [0072.232] GetActiveWindow () returned 0x7002e [0072.233] GetFocus () returned 0x7002e [0072.233] MessageBoxW (hWnd=0x7002e, lpText="Vvk4Am33q21/lgjSYBi9KA==", lpCaption="", uType=0x0) returned 1 [0072.234] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0072.234] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0072.235] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0072.235] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0072.235] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0072.236] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0072.243] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x40020c) returned 0x1 [0072.244] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0072.244] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0072.411] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0072.421] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0072.421] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0072.421] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x40020c) returned 0x1 [0072.423] SetFocus (hWnd=0x7002e) returned 0x40020c [0072.444] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0072.523] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0072.523] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0072.524] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0072.524] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x40020c, lParam=0x0) returned 0x0 [0072.532] IsWindow (hWnd=0x7002e) returned 1 [0072.532] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0072.532] IsWindow (hWnd=0x7002e) returned 1 [0072.532] SetFocus (hWnd=0x7002e) returned 0x7002e [0072.533] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0072.533] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0072.533] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0072.533] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml", lpFilePart=0x0) returned 0x77 [0072.533] GetLastError () returned 0x0 [0072.533] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml", dwFileAttributes=0x80) returned 1 [0072.534] GetLastError () returned 0x0 [0072.534] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml", lpFilePart=0x0) returned 0x77 [0072.534] GetLastError () returned 0x0 [0072.534] SetErrorMode (uMode=0x1) returned 0x0 [0072.534] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32ww.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0072.534] GetLastError () returned 0x0 [0072.534] GetFileType (hFile=0x444) returned 0x1 [0072.535] SetErrorMode (uMode=0x0) returned 0x1 [0072.535] GetFileType (hFile=0x444) returned 0x1 [0072.535] GetFileSize (in: hFile=0x444, lpFileSizeHigh=0x8fe9a4 | out: lpFileSizeHigh=0x8fe9a4*=0x0) returned 0x4f3f4 [0072.535] GetLastError () returned 0x0 [0072.536] ReadFile (in: hFile=0x444, lpBuffer=0x3abeb00, nNumberOfBytesToRead=0x4f3f4, lpNumberOfBytesRead=0x8fe94c, lpOverlapped=0x0 | out: lpBuffer=0x3abeb00*, lpNumberOfBytesRead=0x8fe94c*=0x4f3f4, lpOverlapped=0x0) returned 1 [0072.547] GetLastError () returned 0x0 [0072.547] CloseHandle (hObject=0x444) returned 1 [0072.547] GetLastError () returned 0x0 [0072.547] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0072.547] GetLastError () returned 0x0 [0072.547] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8f4 | out: phKey=0x8fe8f4*=0x9f6620) returned 1 [0072.547] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0072.547] GetLastError () returned 0x0 [0072.547] CryptSetKeyParam (hKey=0x9f6620, dwParam=0x4, pbData=0x2a9ec9c*=0x1, dwFlags=0x0) returned 1 [0072.547] GetLastError () returned 0x0 [0072.547] CryptSetKeyParam (hKey=0x9f6620, dwParam=0x1, pbData=0x2a9ec68, dwFlags=0x0) returned 1 [0072.547] GetLastError () returned 0x0 [0072.554] CryptEncrypt (in: hKey=0x9f6620, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b0df10*, pdwDataLen=0x8fe9ac*=0x4f400, dwBufLen=0x4f400 | out: pbData=0x3b0df10*, pdwDataLen=0x8fe9ac*=0x4f400) returned 1 [0072.554] GetLastError () returned 0x0 [0072.554] CryptEncrypt (in: hKey=0x9f6620, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2a9ecc0*, pdwDataLen=0x8fe9b4*=0x0, dwBufLen=0x10 | out: pbData=0x2a9ecc0*, pdwDataLen=0x8fe9b4*=0x10) returned 1 [0072.554] GetLastError () returned 0x0 [0072.555] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml", lpFilePart=0x0) returned 0x77 [0072.555] GetLastError () returned 0x0 [0072.555] SetErrorMode (uMode=0x1) returned 0x0 [0072.555] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32ww.msi.16.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0072.561] GetLastError () returned 0xb7 [0072.561] GetFileType (hFile=0x444) returned 0x1 [0072.561] SetErrorMode (uMode=0x0) returned 0x1 [0072.561] GetFileType (hFile=0x444) returned 0x1 [0072.561] WriteFile (in: hFile=0x444, lpBuffer=0x3b0df10*, nNumberOfBytesToWrite=0x4f400, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x3b0df10*, lpNumberOfBytesWritten=0x8fe958*=0x4f400, lpOverlapped=0x0) returned 1 [0072.566] GetLastError () returned 0xb7 [0072.566] CloseHandle (hObject=0x444) returned 1 [0072.575] GetLastError () returned 0xb7 [0072.575] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml.Vvk4Am33q21#lgjSYBi9KA==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml.Vvk4Am33q21#lgjSYBi9KA==.bwall", lpFilePart=0x0) returned 0x96 [0072.575] GetLastError () returned 0xb7 [0072.575] SetErrorMode (uMode=0x1) returned 0x0 [0072.575] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml.Vvk4Am33q21#lgjSYBi9KA==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32ww.msi.16.x-none.xml.vvk4am33q21#lgjsybi9ka==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0072.575] GetLastError () returned 0x0 [0072.575] GetFileType (hFile=0x444) returned 0x1 [0072.575] SetErrorMode (uMode=0x0) returned 0x1 [0072.575] GetFileType (hFile=0x444) returned 0x1 [0072.576] WriteFile (in: hFile=0x444, lpBuffer=0x3b0df10*, nNumberOfBytesToWrite=0x4f400, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x3b0df10*, lpNumberOfBytesWritten=0x8fe958*=0x4f400, lpOverlapped=0x0) returned 1 [0072.582] GetLastError () returned 0x0 [0072.582] CloseHandle (hObject=0x444) returned 1 [0072.587] GetLastError () returned 0x0 [0072.587] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml", lpFilePart=0x0) returned 0x77 [0072.587] GetLastError () returned 0x0 [0072.587] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32ww.msi.16.x-none.xml")) returned 1 [0072.590] GetLastError () returned 0x0 [0072.591] GetProcessWindowStation () returned 0x13c [0072.591] GetActiveWindow () returned 0x7002e [0072.591] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0072.591] GetCurrentThreadId () returned 0x540 [0072.591] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c42fa, lParam=0x0) returned 1 [0072.591] IsWindowVisible (hWnd=0x7002e) returned 0 [0072.591] IsWindowVisible (hWnd=0x4020e) returned 0 [0072.592] IsWindowVisible (hWnd=0x60044) returned 0 [0072.592] IsWindowVisible (hWnd=0x2021a) returned 0 [0072.592] IsWindowVisible (hWnd=0x8004a) returned 0 [0072.592] GetActiveWindow () returned 0x7002e [0072.592] GetFocus () returned 0x7002e [0072.592] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0072.594] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0072.594] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0072.595] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0072.596] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0072.596] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0072.596] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0072.606] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x41020c) returned 0x1 [0072.607] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0072.607] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0072.859] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0072.874] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0072.874] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0072.874] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x41020c) returned 0x1 [0072.875] SetFocus (hWnd=0x7002e) returned 0x41020c [0072.878] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0072.879] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0072.879] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0072.880] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0072.880] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x41020c, lParam=0x0) returned 0x0 [0072.886] IsWindow (hWnd=0x7002e) returned 1 [0072.886] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0072.887] IsWindow (hWnd=0x7002e) returned 1 [0072.887] SetFocus (hWnd=0x7002e) returned 0x7002e [0072.887] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0072.887] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0072.887] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0072.887] GetProcessWindowStation () returned 0x13c [0072.887] GetActiveWindow () returned 0x7002e [0072.888] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0072.888] GetCurrentThreadId () returned 0x540 [0072.888] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c429a, lParam=0x0) returned 1 [0072.888] IsWindowVisible (hWnd=0x7002e) returned 0 [0072.888] IsWindowVisible (hWnd=0x4020e) returned 0 [0072.888] IsWindowVisible (hWnd=0x60044) returned 0 [0072.889] IsWindowVisible (hWnd=0x2021a) returned 0 [0072.889] IsWindowVisible (hWnd=0x8004a) returned 0 [0072.889] GetActiveWindow () returned 0x7002e [0072.889] GetFocus () returned 0x7002e [0072.889] MessageBoxW (hWnd=0x7002e, lpText="M1igYQZjyGyq4DOB/BiTvg==", lpCaption="", uType=0x0) returned 1 [0072.890] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0072.891] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0072.891] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0072.892] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0072.892] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0072.892] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0072.901] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x42020c) returned 0x1 [0072.902] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0072.902] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0073.003] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0073.010] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0073.010] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0073.010] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x42020c) returned 0x1 [0073.012] SetFocus (hWnd=0x7002e) returned 0x42020c [0073.014] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0073.015] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0073.015] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0073.015] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0073.016] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x42020c, lParam=0x0) returned 0x0 [0073.020] IsWindow (hWnd=0x7002e) returned 1 [0073.020] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0073.020] IsWindow (hWnd=0x7002e) returned 1 [0073.020] SetFocus (hWnd=0x7002e) returned 0x7002e [0073.020] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0073.020] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0073.020] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0073.020] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x75 [0073.020] GetLastError () returned 0x0 [0073.021] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml", dwFileAttributes=0x80) returned 1 [0073.022] GetLastError () returned 0x0 [0073.022] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x75 [0073.022] GetLastError () returned 0x0 [0073.022] SetErrorMode (uMode=0x1) returned 0x0 [0073.022] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0073.022] GetLastError () returned 0x0 [0073.022] GetFileType (hFile=0x444) returned 0x1 [0073.022] SetErrorMode (uMode=0x0) returned 0x1 [0073.023] GetFileType (hFile=0x444) returned 0x1 [0073.023] GetFileSize (in: hFile=0x444, lpFileSizeHigh=0x8fe9a4 | out: lpFileSizeHigh=0x8fe9a4*=0x0) returned 0x19870 [0073.023] GetLastError () returned 0x0 [0073.023] ReadFile (in: hFile=0x444, lpBuffer=0x3b5d330, nNumberOfBytesToRead=0x19870, lpNumberOfBytesRead=0x8fe94c, lpOverlapped=0x0 | out: lpBuffer=0x3b5d330*, lpNumberOfBytesRead=0x8fe94c*=0x19870, lpOverlapped=0x0) returned 1 [0073.030] GetLastError () returned 0x0 [0073.030] CloseHandle (hObject=0x444) returned 1 [0073.030] GetLastError () returned 0x0 [0073.030] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0073.030] GetLastError () returned 0x0 [0073.030] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8f4 | out: phKey=0x8fe8f4*=0x9f65e0) returned 1 [0073.031] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0073.031] GetLastError () returned 0x0 [0073.031] CryptSetKeyParam (hKey=0x9f65e0, dwParam=0x4, pbData=0x2aa4324*=0x1, dwFlags=0x0) returned 1 [0073.031] GetLastError () returned 0x0 [0073.031] CryptSetKeyParam (hKey=0x9f65e0, dwParam=0x1, pbData=0x2aa42f0, dwFlags=0x0) returned 1 [0073.031] GetLastError () returned 0x0 [0073.033] CryptEncrypt (in: hKey=0x9f65e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b76bc0*, pdwDataLen=0x8fe9ac*=0x19880, dwBufLen=0x19880 | out: pbData=0x3b76bc0*, pdwDataLen=0x8fe9ac*=0x19880) returned 1 [0073.034] GetLastError () returned 0x0 [0073.034] CryptEncrypt (in: hKey=0x9f65e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2aa4348*, pdwDataLen=0x8fe9b4*=0x0, dwBufLen=0x10 | out: pbData=0x2aa4348*, pdwDataLen=0x8fe9b4*=0x10) returned 1 [0073.034] GetLastError () returned 0x0 [0073.034] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x75 [0073.034] GetLastError () returned 0x0 [0073.034] SetErrorMode (uMode=0x1) returned 0x0 [0073.034] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0073.035] GetLastError () returned 0xb7 [0073.036] GetFileType (hFile=0x444) returned 0x1 [0073.036] SetErrorMode (uMode=0x0) returned 0x1 [0073.036] GetFileType (hFile=0x444) returned 0x1 [0073.036] WriteFile (in: hFile=0x444, lpBuffer=0x3b76bc0*, nNumberOfBytesToWrite=0x19880, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x3b76bc0*, lpNumberOfBytesWritten=0x8fe958*=0x19880, lpOverlapped=0x0) returned 1 [0073.038] GetLastError () returned 0xb7 [0073.038] CloseHandle (hObject=0x444) returned 1 [0073.058] GetLastError () returned 0xb7 [0073.058] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml.M1igYQZjyGyq4DOB#BiTvg==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml.M1igYQZjyGyq4DOB#BiTvg==.bwall", lpFilePart=0x0) returned 0x94 [0073.058] GetLastError () returned 0xb7 [0073.059] SetErrorMode (uMode=0x1) returned 0x0 [0073.059] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml.M1igYQZjyGyq4DOB#BiTvg==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml.m1igyqzjygyq4dob#bitvg==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0073.061] GetLastError () returned 0x0 [0073.061] GetFileType (hFile=0x444) returned 0x1 [0073.061] SetErrorMode (uMode=0x0) returned 0x1 [0073.061] GetFileType (hFile=0x444) returned 0x1 [0073.061] WriteFile (in: hFile=0x444, lpBuffer=0x3b76bc0*, nNumberOfBytesToWrite=0x19880, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x3b76bc0*, lpNumberOfBytesWritten=0x8fe958*=0x19880, lpOverlapped=0x0) returned 1 [0073.067] GetLastError () returned 0x0 [0073.067] CloseHandle (hObject=0x444) returned 1 [0073.070] GetLastError () returned 0x0 [0073.070] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x75 [0073.070] GetLastError () returned 0x0 [0073.070] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml")) returned 1 [0073.078] GetLastError () returned 0x0 [0073.083] GetProcessWindowStation () returned 0x13c [0073.083] GetActiveWindow () returned 0x7002e [0073.083] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0073.083] GetCurrentThreadId () returned 0x540 [0073.084] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c420a, lParam=0x0) returned 1 [0073.084] IsWindowVisible (hWnd=0x7002e) returned 0 [0073.084] IsWindowVisible (hWnd=0x4020e) returned 0 [0073.084] IsWindowVisible (hWnd=0x60044) returned 0 [0073.084] IsWindowVisible (hWnd=0x2021a) returned 0 [0073.084] IsWindowVisible (hWnd=0x8004a) returned 0 [0073.084] GetActiveWindow () returned 0x7002e [0073.084] GetFocus () returned 0x7002e [0073.084] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0073.086] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0073.089] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0073.090] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0073.090] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0073.090] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0073.091] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0073.099] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x43020c) returned 0x1 [0073.100] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0073.100] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0073.205] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0073.213] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0073.213] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0073.213] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x43020c) returned 0x1 [0073.215] SetFocus (hWnd=0x7002e) returned 0x43020c [0073.217] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0073.218] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0073.218] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0073.218] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0073.218] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x43020c, lParam=0x0) returned 0x0 [0073.223] IsWindow (hWnd=0x7002e) returned 1 [0073.223] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0073.223] IsWindow (hWnd=0x7002e) returned 1 [0073.223] SetFocus (hWnd=0x7002e) returned 0x7002e [0073.223] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0073.223] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0073.223] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0073.224] GetProcessWindowStation () returned 0x13c [0073.224] GetActiveWindow () returned 0x7002e [0073.224] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0073.224] GetCurrentThreadId () returned 0x540 [0073.224] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c432a, lParam=0x0) returned 1 [0073.224] IsWindowVisible (hWnd=0x7002e) returned 0 [0073.224] IsWindowVisible (hWnd=0x4020e) returned 0 [0073.224] IsWindowVisible (hWnd=0x60044) returned 0 [0073.224] IsWindowVisible (hWnd=0x2021a) returned 0 [0073.225] IsWindowVisible (hWnd=0x8004a) returned 0 [0073.225] GetActiveWindow () returned 0x7002e [0073.225] GetFocus () returned 0x7002e [0073.225] MessageBoxW (hWnd=0x7002e, lpText="09kiW8wQhlJwyj55fuGyLg==", lpCaption="", uType=0x0) returned 1 [0073.226] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0073.226] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0073.229] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0073.230] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0073.230] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0073.230] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0073.237] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x44020c) returned 0x1 [0073.238] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0073.238] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0073.421] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0073.428] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0073.429] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0073.429] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x44020c) returned 0x1 [0073.430] SetFocus (hWnd=0x7002e) returned 0x44020c [0073.432] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0073.434] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0073.434] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0073.434] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0073.434] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x44020c, lParam=0x0) returned 0x0 [0073.439] IsWindow (hWnd=0x7002e) returned 1 [0073.439] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0073.439] IsWindow (hWnd=0x7002e) returned 1 [0073.439] SetFocus (hWnd=0x7002e) returned 0x7002e [0073.439] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0073.439] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0073.439] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0073.439] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml", lpFilePart=0x0) returned 0x78 [0073.439] GetLastError () returned 0x0 [0073.439] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml", dwFileAttributes=0x80) returned 1 [0073.441] GetLastError () returned 0x0 [0073.441] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml", lpFilePart=0x0) returned 0x78 [0073.441] GetLastError () returned 0x0 [0073.441] SetErrorMode (uMode=0x1) returned 0x0 [0073.441] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0073.441] GetLastError () returned 0x0 [0073.441] GetFileType (hFile=0x444) returned 0x1 [0073.441] SetErrorMode (uMode=0x0) returned 0x1 [0073.441] GetFileType (hFile=0x444) returned 0x1 [0073.441] GetFileSize (in: hFile=0x444, lpFileSizeHigh=0x8fe9a4 | out: lpFileSizeHigh=0x8fe9a4*=0x0) returned 0x7fa [0073.441] GetLastError () returned 0x0 [0073.442] ReadFile (in: hFile=0x444, lpBuffer=0x2aaa148, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe94c, lpOverlapped=0x0 | out: lpBuffer=0x2aaa148*, lpNumberOfBytesRead=0x8fe94c*=0x7fa, lpOverlapped=0x0) returned 1 [0073.443] GetLastError () returned 0x0 [0073.443] CloseHandle (hObject=0x444) returned 1 [0073.443] GetLastError () returned 0x0 [0073.443] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0073.443] GetLastError () returned 0x0 [0073.443] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8f4 | out: phKey=0x8fe8f4*=0x9f6220) returned 1 [0073.443] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0073.443] GetLastError () returned 0x0 [0073.443] CryptSetKeyParam (hKey=0x9f6220, dwParam=0x4, pbData=0x2aab1bc*=0x1, dwFlags=0x0) returned 1 [0073.443] GetLastError () returned 0x0 [0073.443] CryptSetKeyParam (hKey=0x9f6220, dwParam=0x1, pbData=0x2aab188, dwFlags=0x0) returned 1 [0073.444] GetLastError () returned 0x0 [0073.444] CryptEncrypt (in: hKey=0x9f6220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2aab1cc*, pdwDataLen=0x8fe9ac*=0x800, dwBufLen=0x800 | out: pbData=0x2aab1cc*, pdwDataLen=0x8fe9ac*=0x800) returned 1 [0073.444] GetLastError () returned 0x0 [0073.444] CryptEncrypt (in: hKey=0x9f6220, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2aab9ec*, pdwDataLen=0x8fe9b4*=0x0, dwBufLen=0x10 | out: pbData=0x2aab9ec*, pdwDataLen=0x8fe9b4*=0x10) returned 1 [0073.444] GetLastError () returned 0x0 [0073.444] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml", lpFilePart=0x0) returned 0x78 [0073.444] GetLastError () returned 0x0 [0073.444] SetErrorMode (uMode=0x1) returned 0x0 [0073.444] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0073.445] GetLastError () returned 0xb7 [0073.445] GetFileType (hFile=0x444) returned 0x1 [0073.445] SetErrorMode (uMode=0x0) returned 0x1 [0073.445] GetFileType (hFile=0x444) returned 0x1 [0073.445] WriteFile (in: hFile=0x444, lpBuffer=0x2aabe84*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x8fe920, lpOverlapped=0x0 | out: lpBuffer=0x2aabe84*, lpNumberOfBytesWritten=0x8fe920*=0x800, lpOverlapped=0x0) returned 1 [0073.464] GetLastError () returned 0xb7 [0073.464] CloseHandle (hObject=0x444) returned 1 [0073.465] GetLastError () returned 0xb7 [0073.465] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml.09kiW8wQhlJwyj55fuGyLg==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml.09kiW8wQhlJwyj55fuGyLg==.bwall", lpFilePart=0x0) returned 0x97 [0073.465] GetLastError () returned 0xb7 [0073.465] SetErrorMode (uMode=0x1) returned 0x0 [0073.465] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml.09kiW8wQhlJwyj55fuGyLg==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml.09kiw8wqhljwyj55fugylg==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x444 [0073.466] GetLastError () returned 0x0 [0073.466] GetFileType (hFile=0x444) returned 0x1 [0073.466] SetErrorMode (uMode=0x0) returned 0x1 [0073.466] GetFileType (hFile=0x444) returned 0x1 [0073.466] WriteFile (in: hFile=0x444, lpBuffer=0x2aad1d0*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x8fe920, lpOverlapped=0x0 | out: lpBuffer=0x2aad1d0*, lpNumberOfBytesWritten=0x8fe920*=0x800, lpOverlapped=0x0) returned 1 [0073.467] GetLastError () returned 0x0 [0073.467] CloseHandle (hObject=0x444) returned 1 [0073.467] GetLastError () returned 0x0 [0073.467] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml", lpFilePart=0x0) returned 0x78 [0073.467] GetLastError () returned 0x0 [0073.467] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml")) returned 1 [0073.469] GetLastError () returned 0x0 [0073.469] GetProcessWindowStation () returned 0x13c [0073.469] GetActiveWindow () returned 0x7002e [0073.469] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0073.469] GetCurrentThreadId () returned 0x540 [0073.469] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c43ba, lParam=0x0) returned 1 [0073.470] IsWindowVisible (hWnd=0x7002e) returned 0 [0073.470] IsWindowVisible (hWnd=0x4020e) returned 0 [0073.470] IsWindowVisible (hWnd=0x60044) returned 0 [0073.470] IsWindowVisible (hWnd=0x2021a) returned 0 [0073.470] IsWindowVisible (hWnd=0x8004a) returned 0 [0073.470] GetActiveWindow () returned 0x7002e [0073.470] GetFocus () returned 0x7002e [0073.470] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0073.471] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0073.471] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0073.472] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0073.473] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0073.473] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0073.473] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0073.489] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x45020c) returned 0x1 [0073.490] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0073.490] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0073.610] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0073.617] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0073.617] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0073.621] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x45020c) returned 0x1 [0073.622] SetFocus (hWnd=0x7002e) returned 0x45020c [0073.624] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0073.626] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0073.626] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0073.626] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0073.626] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x45020c, lParam=0x0) returned 0x0 [0073.631] IsWindow (hWnd=0x7002e) returned 1 [0073.631] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0073.631] IsWindow (hWnd=0x7002e) returned 1 [0073.631] SetFocus (hWnd=0x7002e) returned 0x7002e [0073.631] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0073.631] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0073.631] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0073.631] GetProcessWindowStation () returned 0x13c [0073.631] GetActiveWindow () returned 0x7002e [0073.632] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0073.632] GetCurrentThreadId () returned 0x540 [0073.632] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c43ea, lParam=0x0) returned 1 [0073.632] IsWindowVisible (hWnd=0x7002e) returned 0 [0073.632] IsWindowVisible (hWnd=0x4020e) returned 0 [0073.632] IsWindowVisible (hWnd=0x60044) returned 0 [0073.632] IsWindowVisible (hWnd=0x2021a) returned 0 [0073.632] IsWindowVisible (hWnd=0x8004a) returned 0 [0073.633] GetActiveWindow () returned 0x7002e [0073.633] GetFocus () returned 0x7002e [0073.633] MessageBoxW (hWnd=0x7002e, lpText="eJ+khozmXgZ/KPFJyf+jRA==", lpCaption="", uType=0x0) returned 1 [0073.636] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0073.636] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0073.637] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0073.638] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0073.638] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0073.638] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0073.645] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x46020c) returned 0x1 [0073.646] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0073.646] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0079.027] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0079.049] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0079.049] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0079.049] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x46020c) returned 0x1 [0079.051] SetFocus (hWnd=0x7002e) returned 0x46020c [0079.053] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0079.054] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0079.054] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0079.054] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0079.055] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x46020c, lParam=0x0) returned 0x0 [0079.062] IsWindow (hWnd=0x7002e) returned 1 [0079.062] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0079.062] IsWindow (hWnd=0x7002e) returned 1 [0079.062] SetFocus (hWnd=0x7002e) returned 0x7002e [0079.063] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0079.063] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0079.063] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0079.063] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x83 [0079.063] GetLastError () returned 0x0 [0079.063] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", dwFileAttributes=0x80) returned 1 [0079.065] GetLastError () returned 0x0 [0079.066] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x83 [0079.066] GetLastError () returned 0x0 [0079.066] SetErrorMode (uMode=0x1) returned 0x0 [0079.066] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0079.066] GetLastError () returned 0x0 [0079.066] GetFileType (hFile=0x3f4) returned 0x1 [0079.066] SetErrorMode (uMode=0x0) returned 0x1 [0079.066] GetFileType (hFile=0x3f4) returned 0x1 [0079.067] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x8fe9a4 | out: lpFileSizeHigh=0x8fe9a4*=0x0) returned 0x17b3c [0079.067] GetLastError () returned 0x0 [0079.068] ReadFile (in: hFile=0x3f4, lpBuffer=0x3b90460, nNumberOfBytesToRead=0x17b3c, lpNumberOfBytesRead=0x8fe94c, lpOverlapped=0x0 | out: lpBuffer=0x3b90460*, lpNumberOfBytesRead=0x8fe94c*=0x17b3c, lpOverlapped=0x0) returned 1 [0079.074] GetLastError () returned 0x0 [0079.074] CloseHandle (hObject=0x3f4) returned 1 [0079.074] GetLastError () returned 0x0 [0079.075] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0079.075] GetLastError () returned 0x0 [0079.075] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8f4 | out: phKey=0x8fe8f4*=0x9f6660) returned 1 [0079.075] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0079.075] GetLastError () returned 0x0 [0079.075] CryptSetKeyParam (hKey=0x9f6660, dwParam=0x4, pbData=0x2ab3088*=0x1, dwFlags=0x0) returned 1 [0079.076] GetLastError () returned 0x0 [0079.076] CryptSetKeyParam (hKey=0x9f6660, dwParam=0x1, pbData=0x2ab3054, dwFlags=0x0) returned 1 [0079.076] GetLastError () returned 0x0 [0079.078] CryptEncrypt (in: hKey=0x9f6660, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3ba7fb8*, pdwDataLen=0x8fe9ac*=0x17b40, dwBufLen=0x17b40 | out: pbData=0x3ba7fb8*, pdwDataLen=0x8fe9ac*=0x17b40) returned 1 [0079.078] GetLastError () returned 0x0 [0079.078] CryptEncrypt (in: hKey=0x9f6660, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ab30ac*, pdwDataLen=0x8fe9b4*=0x0, dwBufLen=0x10 | out: pbData=0x2ab30ac*, pdwDataLen=0x8fe9b4*=0x10) returned 1 [0079.078] GetLastError () returned 0x0 [0079.079] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x83 [0079.079] GetLastError () returned 0x0 [0079.079] SetErrorMode (uMode=0x1) returned 0x0 [0079.079] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0079.083] GetLastError () returned 0xb7 [0079.084] GetFileType (hFile=0x3f4) returned 0x1 [0079.084] SetErrorMode (uMode=0x0) returned 0x1 [0079.084] GetFileType (hFile=0x3f4) returned 0x1 [0079.084] WriteFile (in: hFile=0x3f4, lpBuffer=0x3ba7fb8*, nNumberOfBytesToWrite=0x17b40, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x3ba7fb8*, lpNumberOfBytesWritten=0x8fe958*=0x17b40, lpOverlapped=0x0) returned 1 [0079.086] GetLastError () returned 0xb7 [0079.086] CloseHandle (hObject=0x3f4) returned 1 [0079.091] GetLastError () returned 0xb7 [0079.091] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.eJ+khozmXgZ#KPFJyf+jRA==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.eJ+khozmXgZ#KPFJyf+jRA==.bwall", lpFilePart=0x0) returned 0xa2 [0079.091] GetLastError () returned 0xb7 [0079.091] SetErrorMode (uMode=0x1) returned 0x0 [0079.091] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.eJ+khozmXgZ#KPFJyf+jRA==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml.ej+khozmxgz#kpfjyf+jra==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0079.092] GetLastError () returned 0x0 [0079.092] GetFileType (hFile=0x3f4) returned 0x1 [0079.092] SetErrorMode (uMode=0x0) returned 0x1 [0079.092] GetFileType (hFile=0x3f4) returned 0x1 [0079.092] WriteFile (in: hFile=0x3f4, lpBuffer=0x3ba7fb8*, nNumberOfBytesToWrite=0x17b40, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x3ba7fb8*, lpNumberOfBytesWritten=0x8fe958*=0x17b40, lpOverlapped=0x0) returned 1 [0079.094] GetLastError () returned 0x0 [0079.094] CloseHandle (hObject=0x3f4) returned 1 [0079.096] GetLastError () returned 0x0 [0079.096] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x83 [0079.096] GetLastError () returned 0x0 [0079.096] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml")) returned 1 [0079.098] GetLastError () returned 0x0 [0079.099] GetProcessWindowStation () returned 0x13c [0079.099] GetActiveWindow () returned 0x7002e [0079.099] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0079.099] GetCurrentThreadId () returned 0x540 [0079.100] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4c8a, lParam=0x0) returned 1 [0079.101] IsWindowVisible (hWnd=0x7002e) returned 0 [0079.101] IsWindowVisible (hWnd=0x4020e) returned 0 [0079.101] IsWindowVisible (hWnd=0x60044) returned 0 [0079.101] IsWindowVisible (hWnd=0x2021a) returned 0 [0079.101] IsWindowVisible (hWnd=0x8004a) returned 0 [0079.101] GetActiveWindow () returned 0x7002e [0079.101] GetFocus () returned 0x7002e [0079.102] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0079.105] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0079.106] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0079.107] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0079.107] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0079.107] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0079.107] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0079.115] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x47020c) returned 0x1 [0079.116] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0079.116] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0079.437] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0079.444] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0079.444] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0079.444] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x47020c) returned 0x1 [0079.445] SetFocus (hWnd=0x7002e) returned 0x47020c [0079.479] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0079.480] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0079.480] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0079.481] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0079.481] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x47020c, lParam=0x0) returned 0x0 [0079.485] IsWindow (hWnd=0x7002e) returned 1 [0079.485] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0079.485] IsWindow (hWnd=0x7002e) returned 1 [0079.485] SetFocus (hWnd=0x7002e) returned 0x7002e [0079.485] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0079.485] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0079.485] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0079.486] GetProcessWindowStation () returned 0x13c [0079.486] GetActiveWindow () returned 0x7002e [0079.486] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0079.486] GetCurrentThreadId () returned 0x540 [0079.486] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4eca, lParam=0x0) returned 1 [0079.486] IsWindowVisible (hWnd=0x7002e) returned 0 [0079.486] IsWindowVisible (hWnd=0x4020e) returned 0 [0079.487] IsWindowVisible (hWnd=0x60044) returned 0 [0079.487] IsWindowVisible (hWnd=0x2021a) returned 0 [0079.487] IsWindowVisible (hWnd=0x8004a) returned 0 [0079.487] GetActiveWindow () returned 0x7002e [0079.487] GetFocus () returned 0x7002e [0079.487] MessageBoxW (hWnd=0x7002e, lpText="B0xrOF1SVX7sFhJLVkzkyg==", lpCaption="", uType=0x0) returned 1 [0079.488] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0079.488] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0079.489] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0079.489] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0079.489] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0079.490] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0079.497] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x48020c) returned 0x1 [0079.498] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0079.498] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0084.834] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0084.847] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0084.847] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0084.847] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x48020c) returned 0x1 [0084.849] SetFocus (hWnd=0x7002e) returned 0x48020c [0084.850] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0084.852] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0084.852] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0084.857] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0084.857] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x48020c, lParam=0x0) returned 0x0 [0084.862] IsWindow (hWnd=0x7002e) returned 1 [0084.862] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0084.862] IsWindow (hWnd=0x7002e) returned 1 [0084.862] SetFocus (hWnd=0x7002e) returned 0x7002e [0084.862] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0084.862] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0084.862] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0084.863] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x76 [0084.863] GetLastError () returned 0x0 [0084.863] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml", dwFileAttributes=0x80) returned 1 [0084.865] GetLastError () returned 0x0 [0084.865] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x76 [0084.865] GetLastError () returned 0x0 [0084.865] SetErrorMode (uMode=0x1) returned 0x0 [0084.865] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0084.865] GetLastError () returned 0x0 [0084.865] GetFileType (hFile=0x3f4) returned 0x1 [0084.866] SetErrorMode (uMode=0x0) returned 0x1 [0084.866] GetFileType (hFile=0x3f4) returned 0x1 [0084.866] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x8fe9a4 | out: lpFileSizeHigh=0x8fe9a4*=0x0) returned 0x4a4a [0084.866] GetLastError () returned 0x0 [0084.866] ReadFile (in: hFile=0x3f4, lpBuffer=0x2ab8740, nNumberOfBytesToRead=0x4a4a, lpNumberOfBytesRead=0x8fe94c, lpOverlapped=0x0 | out: lpBuffer=0x2ab8740*, lpNumberOfBytesRead=0x8fe94c*=0x4a4a, lpOverlapped=0x0) returned 1 [0084.871] GetLastError () returned 0x0 [0084.871] CloseHandle (hObject=0x3f4) returned 1 [0084.871] GetLastError () returned 0x0 [0084.871] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0084.871] GetLastError () returned 0x0 [0084.871] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8f4 | out: phKey=0x8fe8f4*=0x9f6760) returned 1 [0084.871] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0084.871] GetLastError () returned 0x0 [0084.872] CryptSetKeyParam (hKey=0x9f6760, dwParam=0x4, pbData=0x2abd200*=0x1, dwFlags=0x0) returned 1 [0084.872] GetLastError () returned 0x0 [0084.872] CryptSetKeyParam (hKey=0x9f6760, dwParam=0x1, pbData=0x2abd1cc, dwFlags=0x0) returned 1 [0084.872] GetLastError () returned 0x0 [0084.872] CryptEncrypt (in: hKey=0x9f6760, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2abd210*, pdwDataLen=0x8fe9ac*=0x4a50, dwBufLen=0x4a50 | out: pbData=0x2abd210*, pdwDataLen=0x8fe9ac*=0x4a50) returned 1 [0084.872] GetLastError () returned 0x0 [0084.872] CryptEncrypt (in: hKey=0x9f6760, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ac1c80*, pdwDataLen=0x8fe9b4*=0x0, dwBufLen=0x10 | out: pbData=0x2ac1c80*, pdwDataLen=0x8fe9b4*=0x10) returned 1 [0084.872] GetLastError () returned 0x0 [0084.872] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x76 [0084.872] GetLastError () returned 0x0 [0084.872] SetErrorMode (uMode=0x1) returned 0x0 [0084.872] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0084.873] GetLastError () returned 0xb7 [0084.873] GetFileType (hFile=0x3f4) returned 0x1 [0084.874] SetErrorMode (uMode=0x0) returned 0x1 [0084.874] GetFileType (hFile=0x3f4) returned 0x1 [0084.874] WriteFile (in: hFile=0x3f4, lpBuffer=0x2abd210*, nNumberOfBytesToWrite=0x4a50, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2abd210*, lpNumberOfBytesWritten=0x8fe958*=0x4a50, lpOverlapped=0x0) returned 1 [0084.875] GetLastError () returned 0xb7 [0084.875] CloseHandle (hObject=0x3f4) returned 1 [0084.876] GetLastError () returned 0xb7 [0084.876] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml.B0xrOF1SVX7sFhJLVkzkyg==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml.B0xrOF1SVX7sFhJLVkzkyg==.bwall", lpFilePart=0x0) returned 0x95 [0084.876] GetLastError () returned 0xb7 [0084.876] SetErrorMode (uMode=0x1) returned 0x0 [0084.877] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml.B0xrOF1SVX7sFhJLVkzkyg==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml.b0xrof1svx7sfhjlvkzkyg==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0084.877] GetLastError () returned 0x0 [0084.877] GetFileType (hFile=0x3f4) returned 0x1 [0084.877] SetErrorMode (uMode=0x0) returned 0x1 [0084.877] GetFileType (hFile=0x3f4) returned 0x1 [0084.877] WriteFile (in: hFile=0x3f4, lpBuffer=0x2abd210*, nNumberOfBytesToWrite=0x4a50, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2abd210*, lpNumberOfBytesWritten=0x8fe958*=0x4a50, lpOverlapped=0x0) returned 1 [0084.878] GetLastError () returned 0x0 [0084.878] CloseHandle (hObject=0x3f4) returned 1 [0084.879] GetLastError () returned 0x0 [0084.879] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x76 [0084.879] GetLastError () returned 0x0 [0084.879] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml")) returned 1 [0084.880] GetLastError () returned 0x0 [0084.881] GetProcessWindowStation () returned 0x13c [0084.881] GetActiveWindow () returned 0x7002e [0084.881] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0084.881] GetCurrentThreadId () returned 0x540 [0084.881] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4daa, lParam=0x0) returned 1 [0084.882] IsWindowVisible (hWnd=0x7002e) returned 0 [0084.882] IsWindowVisible (hWnd=0x4020e) returned 0 [0084.882] IsWindowVisible (hWnd=0x60044) returned 0 [0084.882] IsWindowVisible (hWnd=0x2021a) returned 0 [0084.882] IsWindowVisible (hWnd=0x8004a) returned 0 [0084.882] GetActiveWindow () returned 0x7002e [0084.882] GetFocus () returned 0x7002e [0084.882] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0084.887] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0084.892] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0084.892] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0084.893] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0084.893] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0084.893] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0084.903] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x49020c) returned 0x1 [0084.904] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0084.904] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0085.084] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0085.091] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0085.091] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0085.091] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x49020c) returned 0x1 [0085.093] SetFocus (hWnd=0x7002e) returned 0x49020c [0085.094] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0085.096] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0085.096] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0085.096] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0085.096] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x49020c, lParam=0x0) returned 0x0 [0085.101] IsWindow (hWnd=0x7002e) returned 1 [0085.101] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0085.101] IsWindow (hWnd=0x7002e) returned 1 [0085.101] SetFocus (hWnd=0x7002e) returned 0x7002e [0085.101] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0085.101] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0085.101] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0085.101] GetProcessWindowStation () returned 0x13c [0085.101] GetActiveWindow () returned 0x7002e [0085.102] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0085.102] GetCurrentThreadId () returned 0x540 [0085.106] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4aaa, lParam=0x0) returned 1 [0085.106] IsWindowVisible (hWnd=0x7002e) returned 0 [0085.106] IsWindowVisible (hWnd=0x4020e) returned 0 [0085.106] IsWindowVisible (hWnd=0x60044) returned 0 [0085.106] IsWindowVisible (hWnd=0x2021a) returned 0 [0085.106] IsWindowVisible (hWnd=0x8004a) returned 0 [0085.106] GetActiveWindow () returned 0x7002e [0085.106] GetFocus () returned 0x7002e [0085.106] MessageBoxW (hWnd=0x7002e, lpText="dotz26ZiORj+WOUIEQZ7KQ==", lpCaption="", uType=0x0) returned 1 [0085.107] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0085.108] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0085.108] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0085.109] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0085.109] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0085.109] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0085.116] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x4a020c) returned 0x1 [0085.117] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0085.117] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0085.479] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0085.490] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0085.490] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0085.490] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x4a020c) returned 0x1 [0085.492] SetFocus (hWnd=0x7002e) returned 0x4a020c [0085.500] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0085.501] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0085.501] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0085.502] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0085.502] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x4a020c, lParam=0x0) returned 0x0 [0085.508] IsWindow (hWnd=0x7002e) returned 1 [0085.508] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0085.508] IsWindow (hWnd=0x7002e) returned 1 [0085.508] SetFocus (hWnd=0x7002e) returned 0x7002e [0085.508] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0085.508] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0085.508] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0085.508] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7b [0085.509] GetLastError () returned 0x0 [0085.509] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", dwFileAttributes=0x80) returned 1 [0085.510] GetLastError () returned 0x0 [0085.510] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7b [0085.510] GetLastError () returned 0x0 [0085.510] SetErrorMode (uMode=0x1) returned 0x0 [0085.511] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0085.511] GetLastError () returned 0x0 [0085.511] GetFileType (hFile=0x3f4) returned 0x1 [0085.511] SetErrorMode (uMode=0x0) returned 0x1 [0085.511] GetFileType (hFile=0x3f4) returned 0x1 [0085.511] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x8fe9a4 | out: lpFileSizeHigh=0x8fe9a4*=0x0) returned 0x5f6 [0085.511] GetLastError () returned 0x0 [0085.511] ReadFile (in: hFile=0x3f4, lpBuffer=0x2ac7858, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe94c, lpOverlapped=0x0 | out: lpBuffer=0x2ac7858*, lpNumberOfBytesRead=0x8fe94c*=0x5f6, lpOverlapped=0x0) returned 1 [0085.513] GetLastError () returned 0x0 [0085.513] CloseHandle (hObject=0x3f4) returned 1 [0085.513] GetLastError () returned 0x0 [0085.513] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0085.513] GetLastError () returned 0x0 [0085.513] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8f4 | out: phKey=0x8fe8f4*=0x9f61a0) returned 1 [0085.513] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0085.513] GetLastError () returned 0x0 [0085.513] CryptSetKeyParam (hKey=0x9f61a0, dwParam=0x4, pbData=0x2ac88cc*=0x1, dwFlags=0x0) returned 1 [0085.513] GetLastError () returned 0x0 [0085.513] CryptSetKeyParam (hKey=0x9f61a0, dwParam=0x1, pbData=0x2ac8898, dwFlags=0x0) returned 1 [0085.513] GetLastError () returned 0x0 [0085.513] CryptEncrypt (in: hKey=0x9f61a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2ac88dc*, pdwDataLen=0x8fe9ac*=0x600, dwBufLen=0x600 | out: pbData=0x2ac88dc*, pdwDataLen=0x8fe9ac*=0x600) returned 1 [0085.513] GetLastError () returned 0x0 [0085.513] CryptEncrypt (in: hKey=0x9f61a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ac8efc*, pdwDataLen=0x8fe9b4*=0x0, dwBufLen=0x10 | out: pbData=0x2ac8efc*, pdwDataLen=0x8fe9b4*=0x10) returned 1 [0085.513] GetLastError () returned 0x0 [0085.514] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7b [0085.514] GetLastError () returned 0x0 [0085.514] SetErrorMode (uMode=0x1) returned 0x0 [0085.514] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0085.515] GetLastError () returned 0xb7 [0085.515] GetFileType (hFile=0x3f4) returned 0x1 [0085.515] SetErrorMode (uMode=0x0) returned 0x1 [0085.515] GetFileType (hFile=0x3f4) returned 0x1 [0085.515] WriteFile (in: hFile=0x3f4, lpBuffer=0x2ac93a4*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x8fe920, lpOverlapped=0x0 | out: lpBuffer=0x2ac93a4*, lpNumberOfBytesWritten=0x8fe920*=0x600, lpOverlapped=0x0) returned 1 [0085.516] GetLastError () returned 0xb7 [0085.516] CloseHandle (hObject=0x3f4) returned 1 [0085.517] GetLastError () returned 0xb7 [0085.517] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.dotz26ZiORj+WOUIEQZ7KQ==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.dotz26ZiORj+WOUIEQZ7KQ==.bwall", lpFilePart=0x0) returned 0x9a [0085.517] GetLastError () returned 0xb7 [0085.517] SetErrorMode (uMode=0x1) returned 0x0 [0085.517] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.dotz26ZiORj+WOUIEQZ7KQ==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml.dotz26ziorj+wouieqz7kq==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0085.521] GetLastError () returned 0x0 [0085.521] GetFileType (hFile=0x3f4) returned 0x1 [0085.521] SetErrorMode (uMode=0x0) returned 0x1 [0085.521] GetFileType (hFile=0x3f4) returned 0x1 [0085.521] WriteFile (in: hFile=0x3f4, lpBuffer=0x2aca6fc*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x8fe920, lpOverlapped=0x0 | out: lpBuffer=0x2aca6fc*, lpNumberOfBytesWritten=0x8fe920*=0x600, lpOverlapped=0x0) returned 1 [0085.522] GetLastError () returned 0x0 [0085.522] CloseHandle (hObject=0x3f4) returned 1 [0085.522] GetLastError () returned 0x0 [0085.522] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7b [0085.522] GetLastError () returned 0x0 [0085.522] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml")) returned 1 [0085.523] GetLastError () returned 0x0 [0085.524] GetProcessWindowStation () returned 0x13c [0085.524] GetActiveWindow () returned 0x7002e [0085.524] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0085.524] GetCurrentThreadId () returned 0x540 [0085.525] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4efa, lParam=0x0) returned 1 [0085.526] IsWindowVisible (hWnd=0x7002e) returned 0 [0085.526] IsWindowVisible (hWnd=0x4020e) returned 0 [0085.526] IsWindowVisible (hWnd=0x60044) returned 0 [0085.526] IsWindowVisible (hWnd=0x2021a) returned 0 [0085.526] IsWindowVisible (hWnd=0x8004a) returned 0 [0085.526] GetActiveWindow () returned 0x7002e [0085.526] GetFocus () returned 0x7002e [0085.526] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0085.527] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0085.527] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0085.528] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0085.528] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0085.528] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0085.529] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0085.535] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x4b020c) returned 0x1 [0085.536] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0085.536] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0085.837] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0085.844] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0085.844] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0085.844] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x4b020c) returned 0x1 [0085.846] SetFocus (hWnd=0x7002e) returned 0x4b020c [0085.847] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0085.849] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0085.849] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0085.849] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0085.849] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x4b020c, lParam=0x0) returned 0x0 [0085.856] IsWindow (hWnd=0x7002e) returned 1 [0085.856] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0085.856] IsWindow (hWnd=0x7002e) returned 1 [0085.856] SetFocus (hWnd=0x7002e) returned 0x7002e [0085.856] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0085.856] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0085.856] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0085.856] GetProcessWindowStation () returned 0x13c [0085.856] GetActiveWindow () returned 0x7002e [0085.856] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0085.857] GetCurrentThreadId () returned 0x540 [0085.857] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4cba, lParam=0x0) returned 1 [0085.857] IsWindowVisible (hWnd=0x7002e) returned 0 [0085.857] IsWindowVisible (hWnd=0x4020e) returned 0 [0085.857] IsWindowVisible (hWnd=0x60044) returned 0 [0085.857] IsWindowVisible (hWnd=0x2021a) returned 0 [0085.857] IsWindowVisible (hWnd=0x8004a) returned 0 [0085.857] GetActiveWindow () returned 0x7002e [0085.857] GetFocus () returned 0x7002e [0085.858] MessageBoxW (hWnd=0x7002e, lpText="jUrvQbMSJBXV4jWRQlRqXA==", lpCaption="", uType=0x0) returned 1 [0085.858] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0085.859] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0085.859] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0085.860] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0085.860] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0085.860] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0085.867] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x4c020c) returned 0x1 [0085.867] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0085.869] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0085.995] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0086.002] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0086.002] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0086.002] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x4c020c) returned 0x1 [0086.003] SetFocus (hWnd=0x7002e) returned 0x4c020c [0086.005] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0086.006] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0086.006] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0086.007] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0086.007] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x4c020c, lParam=0x0) returned 0x0 [0086.014] IsWindow (hWnd=0x7002e) returned 1 [0086.014] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0086.014] IsWindow (hWnd=0x7002e) returned 1 [0086.014] SetFocus (hWnd=0x7002e) returned 0x7002e [0086.014] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0086.014] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0086.014] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0086.014] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x72 [0086.014] GetLastError () returned 0x0 [0086.014] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml", dwFileAttributes=0x80) returned 1 [0086.015] GetLastError () returned 0x0 [0086.015] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x72 [0086.015] GetLastError () returned 0x0 [0086.015] SetErrorMode (uMode=0x1) returned 0x0 [0086.015] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0086.015] GetLastError () returned 0x0 [0086.015] GetFileType (hFile=0x3f4) returned 0x1 [0086.015] SetErrorMode (uMode=0x0) returned 0x1 [0086.015] GetFileType (hFile=0x3f4) returned 0x1 [0086.015] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x8fe9a4 | out: lpFileSizeHigh=0x8fe9a4*=0x0) returned 0x2b28 [0086.015] GetLastError () returned 0x0 [0086.015] ReadFile (in: hFile=0x3f4, lpBuffer=0x2ad04ec, nNumberOfBytesToRead=0x2b28, lpNumberOfBytesRead=0x8fe94c, lpOverlapped=0x0 | out: lpBuffer=0x2ad04ec*, lpNumberOfBytesRead=0x8fe94c*=0x2b28, lpOverlapped=0x0) returned 1 [0086.017] GetLastError () returned 0x0 [0086.017] CloseHandle (hObject=0x3f4) returned 1 [0086.017] GetLastError () returned 0x0 [0086.017] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0086.017] GetLastError () returned 0x0 [0086.017] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8f4 | out: phKey=0x8fe8f4*=0x9f6260) returned 1 [0086.017] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0086.017] GetLastError () returned 0x0 [0086.017] CryptSetKeyParam (hKey=0x9f6260, dwParam=0x4, pbData=0x2ad3088*=0x1, dwFlags=0x0) returned 1 [0086.017] GetLastError () returned 0x0 [0086.017] CryptSetKeyParam (hKey=0x9f6260, dwParam=0x1, pbData=0x2ad3054, dwFlags=0x0) returned 1 [0086.017] GetLastError () returned 0x0 [0086.018] CryptEncrypt (in: hKey=0x9f6260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2ad3098*, pdwDataLen=0x8fe9ac*=0x2b30, dwBufLen=0x2b30 | out: pbData=0x2ad3098*, pdwDataLen=0x8fe9ac*=0x2b30) returned 1 [0086.018] GetLastError () returned 0x0 [0086.018] CryptEncrypt (in: hKey=0x9f6260, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ad5be8*, pdwDataLen=0x8fe9b4*=0x0, dwBufLen=0x10 | out: pbData=0x2ad5be8*, pdwDataLen=0x8fe9b4*=0x10) returned 1 [0086.018] GetLastError () returned 0x0 [0086.018] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x72 [0086.018] GetLastError () returned 0x0 [0086.018] SetErrorMode (uMode=0x1) returned 0x0 [0086.018] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0086.019] GetLastError () returned 0xb7 [0086.019] GetFileType (hFile=0x3f4) returned 0x1 [0086.019] SetErrorMode (uMode=0x0) returned 0x1 [0086.019] GetFileType (hFile=0x3f4) returned 0x1 [0086.019] WriteFile (in: hFile=0x3f4, lpBuffer=0x2ad3098*, nNumberOfBytesToWrite=0x2b30, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2ad3098*, lpNumberOfBytesWritten=0x8fe958*=0x2b30, lpOverlapped=0x0) returned 1 [0086.020] GetLastError () returned 0xb7 [0086.020] CloseHandle (hObject=0x3f4) returned 1 [0086.021] GetLastError () returned 0xb7 [0086.021] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml.jUrvQbMSJBXV4jWRQlRqXA==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml.jUrvQbMSJBXV4jWRQlRqXA==.bwall", lpFilePart=0x0) returned 0x91 [0086.021] GetLastError () returned 0xb7 [0086.021] SetErrorMode (uMode=0x1) returned 0x0 [0086.021] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml.jUrvQbMSJBXV4jWRQlRqXA==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml.jurvqbmsjbxv4jwrqlrqxa==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0086.022] GetLastError () returned 0x0 [0086.022] GetFileType (hFile=0x3f4) returned 0x1 [0086.022] SetErrorMode (uMode=0x0) returned 0x1 [0086.022] GetFileType (hFile=0x3f4) returned 0x1 [0086.022] WriteFile (in: hFile=0x3f4, lpBuffer=0x2ad3098*, nNumberOfBytesToWrite=0x2b30, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2ad3098*, lpNumberOfBytesWritten=0x8fe958*=0x2b30, lpOverlapped=0x0) returned 1 [0086.023] GetLastError () returned 0x0 [0086.023] CloseHandle (hObject=0x3f4) returned 1 [0086.025] GetLastError () returned 0x0 [0086.025] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x72 [0086.025] GetLastError () returned 0x0 [0086.025] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml")) returned 1 [0086.026] GetLastError () returned 0x0 [0086.026] GetProcessWindowStation () returned 0x13c [0086.026] GetActiveWindow () returned 0x7002e [0086.026] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0086.026] GetCurrentThreadId () returned 0x540 [0086.026] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4f2a, lParam=0x0) returned 1 [0086.027] IsWindowVisible (hWnd=0x7002e) returned 0 [0086.027] IsWindowVisible (hWnd=0x4020e) returned 0 [0086.027] IsWindowVisible (hWnd=0x60044) returned 0 [0086.027] IsWindowVisible (hWnd=0x2021a) returned 0 [0086.027] IsWindowVisible (hWnd=0x8004a) returned 0 [0086.027] GetActiveWindow () returned 0x7002e [0086.027] GetFocus () returned 0x7002e [0086.027] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0086.028] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0086.028] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0086.029] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0086.029] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0086.029] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0086.030] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0086.036] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x4d020c) returned 0x1 [0086.037] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0086.037] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0086.193] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0086.201] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0086.201] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0086.201] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x4d020c) returned 0x1 [0086.202] SetFocus (hWnd=0x7002e) returned 0x4d020c [0086.204] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0086.206] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0086.206] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0086.206] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0086.206] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x4d020c, lParam=0x0) returned 0x0 [0086.210] IsWindow (hWnd=0x7002e) returned 1 [0086.210] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0086.211] IsWindow (hWnd=0x7002e) returned 1 [0086.211] SetFocus (hWnd=0x7002e) returned 0x7002e [0086.211] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0086.211] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0086.211] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0086.211] GetProcessWindowStation () returned 0x13c [0086.211] GetActiveWindow () returned 0x7002e [0086.211] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0086.211] GetCurrentThreadId () returned 0x540 [0086.215] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4cea, lParam=0x0) returned 1 [0086.215] IsWindowVisible (hWnd=0x7002e) returned 0 [0086.215] IsWindowVisible (hWnd=0x4020e) returned 0 [0086.216] IsWindowVisible (hWnd=0x60044) returned 0 [0086.216] IsWindowVisible (hWnd=0x2021a) returned 0 [0086.216] IsWindowVisible (hWnd=0x8004a) returned 0 [0086.216] GetActiveWindow () returned 0x7002e [0086.216] GetFocus () returned 0x7002e [0086.216] MessageBoxW (hWnd=0x7002e, lpText="J+mNCaJSj38MCeKF6sIt2Q==", lpCaption="", uType=0x0) returned 1 [0086.217] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0086.217] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0086.218] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0086.218] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0086.218] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0086.219] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0086.225] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x4e020c) returned 0x1 [0086.226] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0086.226] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0086.412] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0086.420] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0086.420] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0086.420] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x4e020c) returned 0x1 [0086.421] SetFocus (hWnd=0x7002e) returned 0x4e020c [0086.423] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0086.424] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0086.424] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0086.425] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0086.425] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x4e020c, lParam=0x0) returned 0x0 [0086.429] IsWindow (hWnd=0x7002e) returned 1 [0086.429] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0086.429] IsWindow (hWnd=0x7002e) returned 1 [0086.429] SetFocus (hWnd=0x7002e) returned 0x7002e [0086.429] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0086.429] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0086.429] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0086.429] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7f [0086.429] GetLastError () returned 0x0 [0086.429] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", dwFileAttributes=0x80) returned 1 [0086.430] GetLastError () returned 0x0 [0086.430] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7f [0086.430] GetLastError () returned 0x0 [0086.432] SetErrorMode (uMode=0x1) returned 0x0 [0086.433] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0086.433] GetLastError () returned 0x0 [0086.433] GetFileType (hFile=0x3f4) returned 0x1 [0086.433] SetErrorMode (uMode=0x0) returned 0x1 [0086.433] GetFileType (hFile=0x3f4) returned 0x1 [0086.433] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x8fe9a4 | out: lpFileSizeHigh=0x8fe9a4*=0x0) returned 0x906 [0086.433] GetLastError () returned 0x0 [0086.433] ReadFile (in: hFile=0x3f4, lpBuffer=0x2adbab8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe94c, lpOverlapped=0x0 | out: lpBuffer=0x2adbab8*, lpNumberOfBytesRead=0x8fe94c*=0x906, lpOverlapped=0x0) returned 1 [0086.436] GetLastError () returned 0x0 [0086.436] CloseHandle (hObject=0x3f4) returned 1 [0086.436] GetLastError () returned 0x0 [0086.436] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0086.436] GetLastError () returned 0x0 [0086.436] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8f4 | out: phKey=0x8fe8f4*=0x9f66a0) returned 1 [0086.436] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0086.436] GetLastError () returned 0x0 [0086.436] CryptSetKeyParam (hKey=0x9f66a0, dwParam=0x4, pbData=0x2adcb2c*=0x1, dwFlags=0x0) returned 1 [0086.436] GetLastError () returned 0x0 [0086.437] CryptSetKeyParam (hKey=0x9f66a0, dwParam=0x1, pbData=0x2adcaf8, dwFlags=0x0) returned 1 [0086.437] GetLastError () returned 0x0 [0086.437] CryptEncrypt (in: hKey=0x9f66a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2adcb3c*, pdwDataLen=0x8fe9ac*=0x910, dwBufLen=0x910 | out: pbData=0x2adcb3c*, pdwDataLen=0x8fe9ac*=0x910) returned 1 [0086.437] GetLastError () returned 0x0 [0086.437] CryptEncrypt (in: hKey=0x9f66a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2add46c*, pdwDataLen=0x8fe9b4*=0x0, dwBufLen=0x10 | out: pbData=0x2add46c*, pdwDataLen=0x8fe9b4*=0x10) returned 1 [0086.437] GetLastError () returned 0x0 [0086.437] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7f [0086.437] GetLastError () returned 0x0 [0086.437] SetErrorMode (uMode=0x1) returned 0x0 [0086.437] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0086.438] GetLastError () returned 0xb7 [0086.438] GetFileType (hFile=0x3f4) returned 0x1 [0086.438] SetErrorMode (uMode=0x0) returned 0x1 [0086.438] GetFileType (hFile=0x3f4) returned 0x1 [0086.438] WriteFile (in: hFile=0x3f4, lpBuffer=0x2add92c*, nNumberOfBytesToWrite=0x910, lpNumberOfBytesWritten=0x8fe920, lpOverlapped=0x0 | out: lpBuffer=0x2add92c*, lpNumberOfBytesWritten=0x8fe920*=0x910, lpOverlapped=0x0) returned 1 [0086.439] GetLastError () returned 0xb7 [0086.439] CloseHandle (hObject=0x3f4) returned 1 [0086.440] GetLastError () returned 0xb7 [0086.440] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.J+mNCaJSj38MCeKF6sIt2Q==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.J+mNCaJSj38MCeKF6sIt2Q==.bwall", lpFilePart=0x0) returned 0x9e [0086.440] GetLastError () returned 0xb7 [0086.440] SetErrorMode (uMode=0x1) returned 0x0 [0086.440] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.J+mNCaJSj38MCeKF6sIt2Q==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml.j+mncajsj38mcekf6sit2q==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0086.440] GetLastError () returned 0x0 [0086.441] GetFileType (hFile=0x3f4) returned 0x1 [0086.441] SetErrorMode (uMode=0x0) returned 0x1 [0086.441] GetFileType (hFile=0x3f4) returned 0x1 [0086.441] WriteFile (in: hFile=0x3f4, lpBuffer=0x2adec94*, nNumberOfBytesToWrite=0x910, lpNumberOfBytesWritten=0x8fe920, lpOverlapped=0x0 | out: lpBuffer=0x2adec94*, lpNumberOfBytesWritten=0x8fe920*=0x910, lpOverlapped=0x0) returned 1 [0086.442] GetLastError () returned 0x0 [0086.442] CloseHandle (hObject=0x3f4) returned 1 [0086.442] GetLastError () returned 0x0 [0086.442] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7f [0086.442] GetLastError () returned 0x0 [0086.442] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml")) returned 1 [0086.443] GetLastError () returned 0x0 [0086.443] GetProcessWindowStation () returned 0x13c [0086.443] GetActiveWindow () returned 0x7002e [0086.443] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0086.443] GetCurrentThreadId () returned 0x540 [0086.444] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4d1a, lParam=0x0) returned 1 [0086.444] IsWindowVisible (hWnd=0x7002e) returned 0 [0086.444] IsWindowVisible (hWnd=0x4020e) returned 0 [0086.444] IsWindowVisible (hWnd=0x60044) returned 0 [0086.444] IsWindowVisible (hWnd=0x2021a) returned 0 [0086.444] IsWindowVisible (hWnd=0x8004a) returned 0 [0086.444] GetActiveWindow () returned 0x7002e [0086.444] GetFocus () returned 0x7002e [0086.444] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0086.445] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0086.445] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0086.480] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0086.480] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0086.480] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0086.481] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0086.487] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x4f020c) returned 0x1 [0086.488] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0086.488] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0086.992] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0087.004] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0087.005] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0087.005] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x4f020c) returned 0x1 [0087.006] SetFocus (hWnd=0x7002e) returned 0x4f020c [0087.008] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0087.014] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0087.014] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0087.014] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0087.014] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x4f020c, lParam=0x0) returned 0x0 [0087.019] IsWindow (hWnd=0x7002e) returned 1 [0087.020] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0087.020] IsWindow (hWnd=0x7002e) returned 1 [0087.020] SetFocus (hWnd=0x7002e) returned 0x7002e [0087.020] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0087.020] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0087.020] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0087.021] GetProcessWindowStation () returned 0x13c [0087.021] GetActiveWindow () returned 0x7002e [0087.021] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0087.021] GetCurrentThreadId () returned 0x540 [0087.022] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4ada, lParam=0x0) returned 1 [0087.022] IsWindowVisible (hWnd=0x7002e) returned 0 [0087.022] IsWindowVisible (hWnd=0x4020e) returned 0 [0087.023] IsWindowVisible (hWnd=0x60044) returned 0 [0087.023] IsWindowVisible (hWnd=0x2021a) returned 0 [0087.023] IsWindowVisible (hWnd=0x8004a) returned 0 [0087.023] GetActiveWindow () returned 0x7002e [0087.023] GetFocus () returned 0x7002e [0087.023] MessageBoxW (hWnd=0x7002e, lpText="+5Edj42nWkBw/z34X7rk3w==", lpCaption="", uType=0x0) returned 1 [0087.025] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0087.025] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0087.026] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0087.026] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0087.026] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0087.026] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0087.033] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x50020c) returned 0x1 [0087.034] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0087.034] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0087.069] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0087.070] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0087.072] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0087.219] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0087.227] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0087.227] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0087.227] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x50020c) returned 0x1 [0087.228] SetFocus (hWnd=0x7002e) returned 0x50020c [0087.230] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0087.232] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0087.232] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0087.232] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0087.232] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x50020c, lParam=0x0) returned 0x0 [0087.236] IsWindow (hWnd=0x7002e) returned 1 [0087.236] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0087.237] IsWindow (hWnd=0x7002e) returned 1 [0087.237] SetFocus (hWnd=0x7002e) returned 0x7002e [0087.237] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0087.237] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0087.237] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0087.237] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x74 [0087.237] GetLastError () returned 0x0 [0087.237] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml", dwFileAttributes=0x80) returned 1 [0087.238] GetLastError () returned 0x0 [0087.239] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x74 [0087.239] GetLastError () returned 0x0 [0087.239] SetErrorMode (uMode=0x1) returned 0x0 [0087.239] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0087.239] GetLastError () returned 0x0 [0087.239] GetFileType (hFile=0x3f4) returned 0x1 [0087.239] SetErrorMode (uMode=0x0) returned 0x1 [0087.239] GetFileType (hFile=0x3f4) returned 0x1 [0087.239] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x8fe9a4 | out: lpFileSizeHigh=0x8fe9a4*=0x0) returned 0x2b8a [0087.239] GetLastError () returned 0x0 [0087.239] ReadFile (in: hFile=0x3f4, lpBuffer=0x2ae4a98, nNumberOfBytesToRead=0x2b8a, lpNumberOfBytesRead=0x8fe94c, lpOverlapped=0x0 | out: lpBuffer=0x2ae4a98*, lpNumberOfBytesRead=0x8fe94c*=0x2b8a, lpOverlapped=0x0) returned 1 [0087.241] GetLastError () returned 0x0 [0087.241] CloseHandle (hObject=0x3f4) returned 1 [0087.241] GetLastError () returned 0x0 [0087.241] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0087.241] GetLastError () returned 0x0 [0087.241] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8f4 | out: phKey=0x8fe8f4*=0x9f66e0) returned 1 [0087.241] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0087.241] GetLastError () returned 0x0 [0087.241] CryptSetKeyParam (hKey=0x9f66e0, dwParam=0x4, pbData=0x2ae7698*=0x1, dwFlags=0x0) returned 1 [0087.242] GetLastError () returned 0x0 [0087.242] CryptSetKeyParam (hKey=0x9f66e0, dwParam=0x1, pbData=0x2ae7664, dwFlags=0x0) returned 1 [0087.242] GetLastError () returned 0x0 [0087.242] CryptEncrypt (in: hKey=0x9f66e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2ae76a8*, pdwDataLen=0x8fe9ac*=0x2b90, dwBufLen=0x2b90 | out: pbData=0x2ae76a8*, pdwDataLen=0x8fe9ac*=0x2b90) returned 1 [0087.242] GetLastError () returned 0x0 [0087.242] CryptEncrypt (in: hKey=0x9f66e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2aea258*, pdwDataLen=0x8fe9b4*=0x0, dwBufLen=0x10 | out: pbData=0x2aea258*, pdwDataLen=0x8fe9b4*=0x10) returned 1 [0087.242] GetLastError () returned 0x0 [0087.242] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x74 [0087.242] GetLastError () returned 0x0 [0087.242] SetErrorMode (uMode=0x1) returned 0x0 [0087.242] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0087.246] GetLastError () returned 0xb7 [0087.246] GetFileType (hFile=0x3f4) returned 0x1 [0087.246] SetErrorMode (uMode=0x0) returned 0x1 [0087.246] GetFileType (hFile=0x3f4) returned 0x1 [0087.246] WriteFile (in: hFile=0x3f4, lpBuffer=0x2ae76a8*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2ae76a8*, lpNumberOfBytesWritten=0x8fe958*=0x2b90, lpOverlapped=0x0) returned 1 [0087.247] GetLastError () returned 0xb7 [0087.247] CloseHandle (hObject=0x3f4) returned 1 [0087.248] GetLastError () returned 0xb7 [0087.248] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml.+5Edj42nWkBw#z34X7rk3w==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml.+5Edj42nWkBw#z34X7rk3w==.bwall", lpFilePart=0x0) returned 0x93 [0087.248] GetLastError () returned 0xb7 [0087.248] SetErrorMode (uMode=0x1) returned 0x0 [0087.248] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml.+5Edj42nWkBw#z34X7rk3w==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml.+5edj42nwkbw#z34x7rk3w==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0087.249] GetLastError () returned 0x0 [0087.249] GetFileType (hFile=0x3f4) returned 0x1 [0087.249] SetErrorMode (uMode=0x0) returned 0x1 [0087.249] GetFileType (hFile=0x3f4) returned 0x1 [0087.249] WriteFile (in: hFile=0x3f4, lpBuffer=0x2ae76a8*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2ae76a8*, lpNumberOfBytesWritten=0x8fe958*=0x2b90, lpOverlapped=0x0) returned 1 [0087.250] GetLastError () returned 0x0 [0087.250] CloseHandle (hObject=0x3f4) returned 1 [0087.251] GetLastError () returned 0x0 [0087.251] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x74 [0087.251] GetLastError () returned 0x0 [0087.251] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml")) returned 1 [0087.252] GetLastError () returned 0x0 [0087.252] GetProcessWindowStation () returned 0x13c [0087.252] GetActiveWindow () returned 0x7002e [0087.252] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0087.252] GetCurrentThreadId () returned 0x540 [0087.253] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4e6a, lParam=0x0) returned 1 [0087.253] IsWindowVisible (hWnd=0x7002e) returned 0 [0087.253] IsWindowVisible (hWnd=0x4020e) returned 0 [0087.253] IsWindowVisible (hWnd=0x60044) returned 0 [0087.253] IsWindowVisible (hWnd=0x2021a) returned 0 [0087.253] IsWindowVisible (hWnd=0x8004a) returned 0 [0087.253] GetActiveWindow () returned 0x7002e [0087.253] GetFocus () returned 0x7002e [0087.253] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0087.254] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0087.255] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0087.255] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0087.256] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0087.256] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0087.259] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0087.267] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x51020c) returned 0x1 [0087.268] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0087.268] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0087.411] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0087.418] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0087.418] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0087.418] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x51020c) returned 0x1 [0087.420] SetFocus (hWnd=0x7002e) returned 0x51020c [0087.422] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0087.423] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0087.423] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0087.423] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0087.423] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x51020c, lParam=0x0) returned 0x0 [0087.427] IsWindow (hWnd=0x7002e) returned 1 [0087.428] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0087.428] IsWindow (hWnd=0x7002e) returned 1 [0087.428] SetFocus (hWnd=0x7002e) returned 0x7002e [0087.428] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0087.428] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0087.428] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0087.428] GetProcessWindowStation () returned 0x13c [0087.428] GetActiveWindow () returned 0x7002e [0087.428] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0087.428] GetCurrentThreadId () returned 0x540 [0087.429] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4c5a, lParam=0x0) returned 1 [0087.429] IsWindowVisible (hWnd=0x7002e) returned 0 [0087.429] IsWindowVisible (hWnd=0x4020e) returned 0 [0087.429] IsWindowVisible (hWnd=0x60044) returned 0 [0087.429] IsWindowVisible (hWnd=0x2021a) returned 0 [0087.429] IsWindowVisible (hWnd=0x8004a) returned 0 [0087.429] GetActiveWindow () returned 0x7002e [0087.429] GetFocus () returned 0x7002e [0087.429] MessageBoxW (hWnd=0x7002e, lpText="sKC6WU2y6SDubZzrkGSf2A==", lpCaption="", uType=0x0) returned 1 [0087.434] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0087.434] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0087.435] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0087.435] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0087.435] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0087.435] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0087.442] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x52020c) returned 0x1 [0087.443] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0087.443] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0087.610] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0087.617] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0087.617] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0087.617] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x52020c) returned 0x1 [0087.621] SetFocus (hWnd=0x7002e) returned 0x52020c [0087.623] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0087.624] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0087.624] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0087.625] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0087.625] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x52020c, lParam=0x0) returned 0x0 [0087.629] IsWindow (hWnd=0x7002e) returned 1 [0087.629] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0087.629] IsWindow (hWnd=0x7002e) returned 1 [0087.629] SetFocus (hWnd=0x7002e) returned 0x7002e [0087.629] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0087.629] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0087.629] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0087.629] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x83 [0087.629] GetLastError () returned 0x0 [0087.630] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", dwFileAttributes=0x80) returned 1 [0087.630] GetLastError () returned 0x0 [0087.630] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x83 [0087.630] GetLastError () returned 0x0 [0087.630] SetErrorMode (uMode=0x1) returned 0x0 [0087.630] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0087.630] GetLastError () returned 0x0 [0087.630] GetFileType (hFile=0x3f4) returned 0x1 [0087.630] SetErrorMode (uMode=0x0) returned 0x1 [0087.631] GetFileType (hFile=0x3f4) returned 0x1 [0087.631] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x8fe9a4 | out: lpFileSizeHigh=0x8fe9a4*=0x0) returned 0x17194 [0087.631] GetLastError () returned 0x0 [0087.632] ReadFile (in: hFile=0x3f4, lpBuffer=0x3bbfb18, nNumberOfBytesToRead=0x17194, lpNumberOfBytesRead=0x8fe94c, lpOverlapped=0x0 | out: lpBuffer=0x3bbfb18*, lpNumberOfBytesRead=0x8fe94c*=0x17194, lpOverlapped=0x0) returned 1 [0087.637] GetLastError () returned 0x0 [0087.637] CloseHandle (hObject=0x3f4) returned 1 [0087.637] GetLastError () returned 0x0 [0087.637] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0087.637] GetLastError () returned 0x0 [0087.637] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8f4 | out: phKey=0x8fe8f4*=0x9f6720) returned 1 [0087.637] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0087.637] GetLastError () returned 0x0 [0087.637] CryptSetKeyParam (hKey=0x9f6720, dwParam=0x4, pbData=0x2aef8f0*=0x1, dwFlags=0x0) returned 1 [0087.637] GetLastError () returned 0x0 [0087.637] CryptSetKeyParam (hKey=0x9f6720, dwParam=0x1, pbData=0x2aef8bc, dwFlags=0x0) returned 1 [0087.637] GetLastError () returned 0x0 [0087.639] CryptEncrypt (in: hKey=0x9f6720, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3bd6cc8*, pdwDataLen=0x8fe9ac*=0x171a0, dwBufLen=0x171a0 | out: pbData=0x3bd6cc8*, pdwDataLen=0x8fe9ac*=0x171a0) returned 1 [0087.639] GetLastError () returned 0x0 [0087.639] CryptEncrypt (in: hKey=0x9f6720, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2aef914*, pdwDataLen=0x8fe9b4*=0x0, dwBufLen=0x10 | out: pbData=0x2aef914*, pdwDataLen=0x8fe9b4*=0x10) returned 1 [0087.640] GetLastError () returned 0x0 [0087.640] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x83 [0087.640] GetLastError () returned 0x0 [0087.640] SetErrorMode (uMode=0x1) returned 0x0 [0087.640] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0087.641] GetLastError () returned 0xb7 [0087.641] GetFileType (hFile=0x3f4) returned 0x1 [0087.641] SetErrorMode (uMode=0x0) returned 0x1 [0087.641] GetFileType (hFile=0x3f4) returned 0x1 [0087.641] WriteFile (in: hFile=0x3f4, lpBuffer=0x3bd6cc8*, nNumberOfBytesToWrite=0x171a0, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x3bd6cc8*, lpNumberOfBytesWritten=0x8fe958*=0x171a0, lpOverlapped=0x0) returned 1 [0087.643] GetLastError () returned 0xb7 [0087.643] CloseHandle (hObject=0x3f4) returned 1 [0087.646] GetLastError () returned 0xb7 [0087.646] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.sKC6WU2y6SDubZzrkGSf2A==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.sKC6WU2y6SDubZzrkGSf2A==.bwall", lpFilePart=0x0) returned 0xa2 [0087.646] GetLastError () returned 0xb7 [0087.646] SetErrorMode (uMode=0x1) returned 0x0 [0087.646] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.sKC6WU2y6SDubZzrkGSf2A==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml.skc6wu2y6sdubzzrkgsf2a==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0087.646] GetLastError () returned 0x0 [0087.646] GetFileType (hFile=0x3f4) returned 0x1 [0087.646] SetErrorMode (uMode=0x0) returned 0x1 [0087.647] GetFileType (hFile=0x3f4) returned 0x1 [0087.647] WriteFile (in: hFile=0x3f4, lpBuffer=0x3bd6cc8*, nNumberOfBytesToWrite=0x171a0, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x3bd6cc8*, lpNumberOfBytesWritten=0x8fe958*=0x171a0, lpOverlapped=0x0) returned 1 [0087.653] GetLastError () returned 0x0 [0087.653] CloseHandle (hObject=0x3f4) returned 1 [0087.655] GetLastError () returned 0x0 [0087.655] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x83 [0087.655] GetLastError () returned 0x0 [0087.655] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml")) returned 1 [0087.656] GetLastError () returned 0x0 [0087.661] GetProcessWindowStation () returned 0x13c [0087.661] GetActiveWindow () returned 0x7002e [0087.661] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0087.661] GetCurrentThreadId () returned 0x540 [0087.661] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4dda, lParam=0x0) returned 1 [0087.661] IsWindowVisible (hWnd=0x7002e) returned 0 [0087.661] IsWindowVisible (hWnd=0x4020e) returned 0 [0087.661] IsWindowVisible (hWnd=0x60044) returned 0 [0087.662] IsWindowVisible (hWnd=0x2021a) returned 0 [0087.662] IsWindowVisible (hWnd=0x8004a) returned 0 [0087.662] GetActiveWindow () returned 0x7002e [0087.662] GetFocus () returned 0x7002e [0087.662] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0087.663] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0087.667] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0087.667] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0087.668] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0087.668] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0087.668] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0087.675] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x53020c) returned 0x1 [0087.676] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0087.676] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0087.820] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0087.827] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0087.828] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0087.828] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x53020c) returned 0x1 [0087.829] SetFocus (hWnd=0x7002e) returned 0x53020c [0087.831] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0087.832] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0087.832] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0087.832] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0087.832] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x53020c, lParam=0x0) returned 0x0 [0087.839] IsWindow (hWnd=0x7002e) returned 1 [0087.839] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0087.839] IsWindow (hWnd=0x7002e) returned 1 [0087.839] SetFocus (hWnd=0x7002e) returned 0x7002e [0087.839] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0087.839] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0087.839] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0087.840] GetProcessWindowStation () returned 0x13c [0087.840] GetActiveWindow () returned 0x7002e [0087.840] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0087.840] GetCurrentThreadId () returned 0x540 [0087.840] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4bfa, lParam=0x0) returned 1 [0087.840] IsWindowVisible (hWnd=0x7002e) returned 0 [0087.840] IsWindowVisible (hWnd=0x4020e) returned 0 [0087.840] IsWindowVisible (hWnd=0x60044) returned 0 [0087.840] IsWindowVisible (hWnd=0x2021a) returned 0 [0087.840] IsWindowVisible (hWnd=0x8004a) returned 0 [0087.841] GetActiveWindow () returned 0x7002e [0087.841] GetFocus () returned 0x7002e [0087.841] MessageBoxW (hWnd=0x7002e, lpText="YJ+jWl71QjHb/PkljWDEdw==", lpCaption="", uType=0x0) returned 1 [0087.842] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0087.842] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0087.843] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0087.843] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0087.843] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0087.843] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0087.850] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x54020c) returned 0x1 [0087.851] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0087.851] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0088.033] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0088.043] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0088.043] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0088.043] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x54020c) returned 0x1 [0088.045] SetFocus (hWnd=0x7002e) returned 0x54020c [0088.047] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0088.048] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0088.048] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0088.048] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0088.048] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x54020c, lParam=0x0) returned 0x0 [0088.053] IsWindow (hWnd=0x7002e) returned 1 [0088.053] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0088.053] IsWindow (hWnd=0x7002e) returned 1 [0088.053] SetFocus (hWnd=0x7002e) returned 0x7002e [0088.053] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0088.053] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0088.053] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0088.053] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x76 [0088.053] GetLastError () returned 0x0 [0088.053] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml", dwFileAttributes=0x80) returned 1 [0088.054] GetLastError () returned 0x0 [0088.055] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x76 [0088.055] GetLastError () returned 0x0 [0088.055] SetErrorMode (uMode=0x1) returned 0x0 [0088.055] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0088.055] GetLastError () returned 0x0 [0088.055] GetFileType (hFile=0x3f4) returned 0x1 [0088.055] SetErrorMode (uMode=0x0) returned 0x1 [0088.057] GetFileType (hFile=0x3f4) returned 0x1 [0088.057] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x8fe9a4 | out: lpFileSizeHigh=0x8fe9a4*=0x0) returned 0x17984 [0088.057] GetLastError () returned 0x0 [0088.058] ReadFile (in: hFile=0x3f4, lpBuffer=0x3bede88, nNumberOfBytesToRead=0x17984, lpNumberOfBytesRead=0x8fe94c, lpOverlapped=0x0 | out: lpBuffer=0x3bede88*, lpNumberOfBytesRead=0x8fe94c*=0x17984, lpOverlapped=0x0) returned 1 [0088.060] GetLastError () returned 0x0 [0088.061] CloseHandle (hObject=0x3f4) returned 1 [0088.061] GetLastError () returned 0x0 [0088.061] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0088.061] GetLastError () returned 0x0 [0088.061] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8f4 | out: phKey=0x8fe8f4*=0x9f60e0) returned 1 [0088.061] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0088.061] GetLastError () returned 0x0 [0088.061] CryptSetKeyParam (hKey=0x9f60e0, dwParam=0x4, pbData=0x2af4fcc*=0x1, dwFlags=0x0) returned 1 [0088.061] GetLastError () returned 0x0 [0088.061] CryptSetKeyParam (hKey=0x9f60e0, dwParam=0x1, pbData=0x2af4f98, dwFlags=0x0) returned 1 [0088.061] GetLastError () returned 0x0 [0088.063] CryptEncrypt (in: hKey=0x9f60e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c05828*, pdwDataLen=0x8fe9ac*=0x17990, dwBufLen=0x17990 | out: pbData=0x3c05828*, pdwDataLen=0x8fe9ac*=0x17990) returned 1 [0088.063] GetLastError () returned 0x0 [0088.063] CryptEncrypt (in: hKey=0x9f60e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2af4ff0*, pdwDataLen=0x8fe9b4*=0x0, dwBufLen=0x10 | out: pbData=0x2af4ff0*, pdwDataLen=0x8fe9b4*=0x10) returned 1 [0088.063] GetLastError () returned 0x0 [0088.063] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x76 [0088.063] GetLastError () returned 0x0 [0088.063] SetErrorMode (uMode=0x1) returned 0x0 [0088.064] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0088.065] GetLastError () returned 0xb7 [0088.065] GetFileType (hFile=0x3f4) returned 0x1 [0088.065] SetErrorMode (uMode=0x0) returned 0x1 [0088.065] GetFileType (hFile=0x3f4) returned 0x1 [0088.065] WriteFile (in: hFile=0x3f4, lpBuffer=0x3c05828*, nNumberOfBytesToWrite=0x17990, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x3c05828*, lpNumberOfBytesWritten=0x8fe958*=0x17990, lpOverlapped=0x0) returned 1 [0088.067] GetLastError () returned 0xb7 [0088.067] CloseHandle (hObject=0x3f4) returned 1 [0088.070] GetLastError () returned 0xb7 [0088.070] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml.YJ+jWl71QjHb#PkljWDEdw==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml.YJ+jWl71QjHb#PkljWDEdw==.bwall", lpFilePart=0x0) returned 0x95 [0088.070] GetLastError () returned 0xb7 [0088.070] SetErrorMode (uMode=0x1) returned 0x0 [0088.070] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml.YJ+jWl71QjHb#PkljWDEdw==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml.yj+jwl71qjhb#pkljwdedw==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0088.070] GetLastError () returned 0x0 [0088.070] GetFileType (hFile=0x3f4) returned 0x1 [0088.070] SetErrorMode (uMode=0x0) returned 0x1 [0088.071] GetFileType (hFile=0x3f4) returned 0x1 [0088.075] WriteFile (in: hFile=0x3f4, lpBuffer=0x3c05828*, nNumberOfBytesToWrite=0x17990, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x3c05828*, lpNumberOfBytesWritten=0x8fe958*=0x17990, lpOverlapped=0x0) returned 1 [0088.077] GetLastError () returned 0x0 [0088.077] CloseHandle (hObject=0x3f4) returned 1 [0088.079] GetLastError () returned 0x0 [0088.079] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x76 [0088.079] GetLastError () returned 0x0 [0088.079] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml")) returned 1 [0088.080] GetLastError () returned 0x0 [0088.080] GetProcessWindowStation () returned 0x13c [0088.080] GetActiveWindow () returned 0x7002e [0088.081] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0088.081] GetCurrentThreadId () returned 0x540 [0088.081] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4a4a, lParam=0x0) returned 1 [0088.081] IsWindowVisible (hWnd=0x7002e) returned 0 [0088.081] IsWindowVisible (hWnd=0x4020e) returned 0 [0088.081] IsWindowVisible (hWnd=0x60044) returned 0 [0088.081] IsWindowVisible (hWnd=0x2021a) returned 0 [0088.081] IsWindowVisible (hWnd=0x8004a) returned 0 [0088.081] GetActiveWindow () returned 0x7002e [0088.082] GetFocus () returned 0x7002e [0088.082] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0088.082] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0088.084] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0088.085] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0088.085] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0088.085] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0088.086] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0088.094] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x55020c) returned 0x1 [0088.094] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0088.094] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0088.229] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0088.236] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0088.236] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0088.236] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x55020c) returned 0x1 [0088.237] SetFocus (hWnd=0x7002e) returned 0x55020c [0088.239] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0088.240] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0088.240] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0088.241] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0088.241] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x55020c, lParam=0x0) returned 0x0 [0088.248] IsWindow (hWnd=0x7002e) returned 1 [0088.248] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0088.248] IsWindow (hWnd=0x7002e) returned 1 [0088.248] SetFocus (hWnd=0x7002e) returned 0x7002e [0088.248] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0088.248] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0088.248] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0088.248] GetProcessWindowStation () returned 0x13c [0088.248] GetActiveWindow () returned 0x7002e [0088.249] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0088.249] GetCurrentThreadId () returned 0x540 [0088.249] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4d4a, lParam=0x0) returned 1 [0088.249] IsWindowVisible (hWnd=0x7002e) returned 0 [0088.249] IsWindowVisible (hWnd=0x4020e) returned 0 [0088.249] IsWindowVisible (hWnd=0x60044) returned 0 [0088.249] IsWindowVisible (hWnd=0x2021a) returned 0 [0088.249] IsWindowVisible (hWnd=0x8004a) returned 0 [0088.249] GetActiveWindow () returned 0x7002e [0088.250] GetFocus () returned 0x7002e [0088.250] MessageBoxW (hWnd=0x7002e, lpText="hRFPkHdQc+zxsTaOmdZ9Tg==", lpCaption="", uType=0x0) returned 1 [0088.251] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0088.251] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0088.252] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0088.252] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0088.252] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0088.252] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0088.261] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x56020c) returned 0x1 [0088.262] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0088.262] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0088.700] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0088.707] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0088.707] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0088.707] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x56020c) returned 0x1 [0088.709] SetFocus (hWnd=0x7002e) returned 0x56020c [0088.711] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0088.715] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0088.715] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0088.715] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0088.715] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x56020c, lParam=0x0) returned 0x0 [0088.719] IsWindow (hWnd=0x7002e) returned 1 [0088.719] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0088.719] IsWindow (hWnd=0x7002e) returned 1 [0088.720] SetFocus (hWnd=0x7002e) returned 0x7002e [0088.720] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0088.720] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0088.720] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0088.720] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x89 [0088.720] GetLastError () returned 0x0 [0088.720] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", dwFileAttributes=0x80) returned 1 [0088.721] GetLastError () returned 0x0 [0088.722] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x89 [0088.722] GetLastError () returned 0x0 [0088.722] SetErrorMode (uMode=0x1) returned 0x0 [0088.722] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0088.722] GetLastError () returned 0x0 [0088.722] GetFileType (hFile=0x3f4) returned 0x1 [0088.722] SetErrorMode (uMode=0x0) returned 0x1 [0088.722] GetFileType (hFile=0x3f4) returned 0x1 [0088.722] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x8fe9a4 | out: lpFileSizeHigh=0x8fe9a4*=0x0) returned 0xafddc [0088.722] GetLastError () returned 0x0 [0088.724] ReadFile (in: hFile=0x3f4, lpBuffer=0x3c1d1d8, nNumberOfBytesToRead=0xafddc, lpNumberOfBytesRead=0x8fe94c, lpOverlapped=0x0 | out: lpBuffer=0x3c1d1d8*, lpNumberOfBytesRead=0x8fe94c*=0xafddc, lpOverlapped=0x0) returned 1 [0088.739] GetLastError () returned 0x0 [0088.739] CloseHandle (hObject=0x3f4) returned 1 [0088.740] GetLastError () returned 0x0 [0088.740] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0088.740] GetLastError () returned 0x0 [0088.740] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8f4 | out: phKey=0x8fe8f4*=0x9f62e0) returned 1 [0088.740] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0088.740] GetLastError () returned 0x0 [0088.740] CryptSetKeyParam (hKey=0x9f62e0, dwParam=0x4, pbData=0x2afa6c4*=0x1, dwFlags=0x0) returned 1 [0088.740] GetLastError () returned 0x0 [0088.740] CryptSetKeyParam (hKey=0x9f62e0, dwParam=0x1, pbData=0x2afa690, dwFlags=0x0) returned 1 [0088.740] GetLastError () returned 0x0 [0088.756] CryptEncrypt (in: hKey=0x9f62e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3cccfd0*, pdwDataLen=0x8fe9ac*=0xafde0, dwBufLen=0xafde0 | out: pbData=0x3cccfd0*, pdwDataLen=0x8fe9ac*=0xafde0) returned 1 [0088.757] GetLastError () returned 0x0 [0088.757] CryptEncrypt (in: hKey=0x9f62e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2afa6e8*, pdwDataLen=0x8fe9b4*=0x0, dwBufLen=0x10 | out: pbData=0x2afa6e8*, pdwDataLen=0x8fe9b4*=0x10) returned 1 [0088.757] GetLastError () returned 0x0 [0088.757] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x89 [0088.757] GetLastError () returned 0x0 [0088.757] SetErrorMode (uMode=0x1) returned 0x0 [0088.757] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0088.763] GetLastError () returned 0xb7 [0088.763] GetFileType (hFile=0x3f4) returned 0x1 [0088.763] SetErrorMode (uMode=0x0) returned 0x1 [0088.763] GetFileType (hFile=0x3f4) returned 0x1 [0088.763] WriteFile (in: hFile=0x3f4, lpBuffer=0x3cccfd0*, nNumberOfBytesToWrite=0xafde0, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x3cccfd0*, lpNumberOfBytesWritten=0x8fe958*=0xafde0, lpOverlapped=0x0) returned 1 [0088.777] GetLastError () returned 0xb7 [0088.777] CloseHandle (hObject=0x3f4) returned 1 [0088.793] GetLastError () returned 0xb7 [0088.793] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.hRFPkHdQc+zxsTaOmdZ9Tg==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.hRFPkHdQc+zxsTaOmdZ9Tg==.bwall", lpFilePart=0x0) returned 0xa8 [0088.793] GetLastError () returned 0xb7 [0088.793] SetErrorMode (uMode=0x1) returned 0x0 [0088.793] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.hRFPkHdQc+zxsTaOmdZ9Tg==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml.hrfpkhdqc+zxstaomdz9tg==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0088.793] GetLastError () returned 0x0 [0088.793] GetFileType (hFile=0x3f4) returned 0x1 [0088.793] SetErrorMode (uMode=0x0) returned 0x1 [0088.793] GetFileType (hFile=0x3f4) returned 0x1 [0088.794] WriteFile (in: hFile=0x3f4, lpBuffer=0x3cccfd0*, nNumberOfBytesToWrite=0xafde0, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x3cccfd0*, lpNumberOfBytesWritten=0x8fe958*=0xafde0, lpOverlapped=0x0) returned 1 [0088.805] GetLastError () returned 0x0 [0088.805] CloseHandle (hObject=0x3f4) returned 1 [0088.820] GetLastError () returned 0x0 [0088.820] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x89 [0088.820] GetLastError () returned 0x0 [0088.820] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml")) returned 1 [0088.829] GetLastError () returned 0x0 [0088.829] GetProcessWindowStation () returned 0x13c [0088.829] GetActiveWindow () returned 0x7002e [0088.829] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0088.829] GetCurrentThreadId () returned 0x540 [0088.830] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4bca, lParam=0x0) returned 1 [0088.830] IsWindowVisible (hWnd=0x7002e) returned 0 [0088.830] IsWindowVisible (hWnd=0x4020e) returned 0 [0088.830] IsWindowVisible (hWnd=0x60044) returned 0 [0088.830] IsWindowVisible (hWnd=0x2021a) returned 0 [0088.830] IsWindowVisible (hWnd=0x8004a) returned 0 [0088.830] GetActiveWindow () returned 0x7002e [0088.830] GetFocus () returned 0x7002e [0088.830] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0088.831] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0088.833] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0088.834] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0088.834] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0088.834] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0088.835] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0088.844] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x57020c) returned 0x1 [0088.845] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0088.845] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0089.139] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0089.146] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0089.146] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0089.147] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x57020c) returned 0x1 [0089.148] SetFocus (hWnd=0x7002e) returned 0x57020c [0089.152] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0089.153] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0089.153] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0089.153] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0089.154] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x57020c, lParam=0x0) returned 0x0 [0089.158] IsWindow (hWnd=0x7002e) returned 1 [0089.158] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0089.158] IsWindow (hWnd=0x7002e) returned 1 [0089.158] SetFocus (hWnd=0x7002e) returned 0x7002e [0089.158] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0089.158] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0089.158] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0089.158] GetProcessWindowStation () returned 0x13c [0089.158] GetActiveWindow () returned 0x7002e [0089.158] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0089.159] GetCurrentThreadId () returned 0x540 [0089.159] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4e9a, lParam=0x0) returned 1 [0089.159] IsWindowVisible (hWnd=0x7002e) returned 0 [0089.159] IsWindowVisible (hWnd=0x4020e) returned 0 [0089.159] IsWindowVisible (hWnd=0x60044) returned 0 [0089.159] IsWindowVisible (hWnd=0x2021a) returned 0 [0089.159] IsWindowVisible (hWnd=0x8004a) returned 0 [0089.159] GetActiveWindow () returned 0x7002e [0089.159] GetFocus () returned 0x7002e [0089.160] MessageBoxW (hWnd=0x7002e, lpText="8sWR6Urc9LTEee0oIUjGtQ==", lpCaption="", uType=0x0) returned 1 [0089.160] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0089.161] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0089.161] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0089.162] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0089.162] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0089.162] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0089.171] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x58020c) returned 0x1 [0089.172] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0089.172] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0089.423] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0089.435] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0089.435] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0089.435] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x58020c) returned 0x1 [0089.437] SetFocus (hWnd=0x7002e) returned 0x58020c [0089.438] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0089.440] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0089.440] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0089.440] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0089.440] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x58020c, lParam=0x0) returned 0x0 [0089.444] IsWindow (hWnd=0x7002e) returned 1 [0089.444] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0089.445] IsWindow (hWnd=0x7002e) returned 1 [0089.445] SetFocus (hWnd=0x7002e) returned 0x7002e [0089.445] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0089.445] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0089.445] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0089.445] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x89 [0089.445] GetLastError () returned 0x0 [0089.445] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", dwFileAttributes=0x80) returned 1 [0089.445] GetLastError () returned 0x0 [0089.445] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x89 [0089.445] GetLastError () returned 0x0 [0089.445] SetErrorMode (uMode=0x1) returned 0x0 [0089.472] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0089.472] GetLastError () returned 0x0 [0089.473] GetFileType (hFile=0x3f4) returned 0x1 [0089.473] SetErrorMode (uMode=0x0) returned 0x1 [0089.473] GetFileType (hFile=0x3f4) returned 0x1 [0089.473] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x8fe9a4 | out: lpFileSizeHigh=0x8fe9a4*=0x0) returned 0x195a4 [0089.473] GetLastError () returned 0x0 [0089.498] ReadFile (in: hFile=0x3f4, lpBuffer=0x3a18010, nNumberOfBytesToRead=0x195a4, lpNumberOfBytesRead=0x8fe94c, lpOverlapped=0x0 | out: lpBuffer=0x3a18010*, lpNumberOfBytesRead=0x8fe94c*=0x195a4, lpOverlapped=0x0) returned 1 [0089.500] GetLastError () returned 0x0 [0089.500] CloseHandle (hObject=0x3f4) returned 1 [0089.500] GetLastError () returned 0x0 [0089.500] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0089.500] GetLastError () returned 0x0 [0089.500] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8f4 | out: phKey=0x8fe8f4*=0x9f67e0) returned 1 [0089.500] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0089.500] GetLastError () returned 0x0 [0089.500] CryptSetKeyParam (hKey=0x9f67e0, dwParam=0x4, pbData=0x2a39520*=0x1, dwFlags=0x0) returned 1 [0089.501] GetLastError () returned 0x0 [0089.501] CryptSetKeyParam (hKey=0x9f67e0, dwParam=0x1, pbData=0x2a394ec, dwFlags=0x0) returned 1 [0089.501] GetLastError () returned 0x0 [0089.502] CryptEncrypt (in: hKey=0x9f67e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a315d0*, pdwDataLen=0x8fe9ac*=0x195b0, dwBufLen=0x195b0 | out: pbData=0x3a315d0*, pdwDataLen=0x8fe9ac*=0x195b0) returned 1 [0089.502] GetLastError () returned 0x0 [0089.503] CryptEncrypt (in: hKey=0x9f67e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2a39544*, pdwDataLen=0x8fe9b4*=0x0, dwBufLen=0x10 | out: pbData=0x2a39544*, pdwDataLen=0x8fe9b4*=0x10) returned 1 [0089.503] GetLastError () returned 0x0 [0089.503] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x89 [0089.503] GetLastError () returned 0x0 [0089.503] SetErrorMode (uMode=0x1) returned 0x0 [0089.503] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0089.504] GetLastError () returned 0xb7 [0089.504] GetFileType (hFile=0x3f4) returned 0x1 [0089.504] SetErrorMode (uMode=0x0) returned 0x1 [0089.504] GetFileType (hFile=0x3f4) returned 0x1 [0089.505] WriteFile (in: hFile=0x3f4, lpBuffer=0x3a315d0*, nNumberOfBytesToWrite=0x195b0, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x3a315d0*, lpNumberOfBytesWritten=0x8fe958*=0x195b0, lpOverlapped=0x0) returned 1 [0089.507] GetLastError () returned 0xb7 [0089.507] CloseHandle (hObject=0x3f4) returned 1 [0089.512] GetLastError () returned 0xb7 [0089.512] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.8sWR6Urc9LTEee0oIUjGtQ==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.8sWR6Urc9LTEee0oIUjGtQ==.bwall", lpFilePart=0x0) returned 0xa8 [0089.512] GetLastError () returned 0xb7 [0089.512] SetErrorMode (uMode=0x1) returned 0x0 [0089.512] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.8sWR6Urc9LTEee0oIUjGtQ==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml.8swr6urc9lteee0oiujgtq==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0089.512] GetLastError () returned 0x0 [0089.513] GetFileType (hFile=0x3f4) returned 0x1 [0089.513] SetErrorMode (uMode=0x0) returned 0x1 [0089.513] GetFileType (hFile=0x3f4) returned 0x1 [0089.513] WriteFile (in: hFile=0x3f4, lpBuffer=0x3a315d0*, nNumberOfBytesToWrite=0x195b0, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x3a315d0*, lpNumberOfBytesWritten=0x8fe958*=0x195b0, lpOverlapped=0x0) returned 1 [0089.515] GetLastError () returned 0x0 [0089.515] CloseHandle (hObject=0x3f4) returned 1 [0089.517] GetLastError () returned 0x0 [0089.517] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x89 [0089.517] GetLastError () returned 0x0 [0089.517] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml")) returned 1 [0089.519] GetLastError () returned 0x0 [0089.525] GetProcessWindowStation () returned 0x13c [0089.525] GetActiveWindow () returned 0x7002e [0089.525] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0089.525] GetCurrentThreadId () returned 0x540 [0089.525] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4a7a, lParam=0x0) returned 1 [0089.525] IsWindowVisible (hWnd=0x7002e) returned 0 [0089.526] IsWindowVisible (hWnd=0x4020e) returned 0 [0089.526] IsWindowVisible (hWnd=0x60044) returned 0 [0089.526] IsWindowVisible (hWnd=0x2021a) returned 0 [0089.526] IsWindowVisible (hWnd=0x8004a) returned 0 [0089.526] GetActiveWindow () returned 0x7002e [0089.526] GetFocus () returned 0x7002e [0089.526] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0089.527] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0089.527] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0089.528] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0089.528] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0089.528] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0089.529] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0089.535] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x59020c) returned 0x1 [0089.536] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0089.536] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0089.673] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0089.680] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0089.683] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0089.683] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x59020c) returned 0x1 [0089.684] SetFocus (hWnd=0x7002e) returned 0x59020c [0089.686] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0089.687] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0089.687] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0089.688] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0089.688] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x59020c, lParam=0x0) returned 0x0 [0089.692] IsWindow (hWnd=0x7002e) returned 1 [0089.692] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0089.692] IsWindow (hWnd=0x7002e) returned 1 [0089.692] SetFocus (hWnd=0x7002e) returned 0x7002e [0089.692] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0089.692] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0089.692] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0089.692] GetProcessWindowStation () returned 0x13c [0089.693] GetActiveWindow () returned 0x7002e [0089.693] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0089.693] GetCurrentThreadId () returned 0x540 [0089.693] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4e9a, lParam=0x0) returned 1 [0089.693] IsWindowVisible (hWnd=0x7002e) returned 0 [0089.693] IsWindowVisible (hWnd=0x4020e) returned 0 [0089.693] IsWindowVisible (hWnd=0x60044) returned 0 [0089.693] IsWindowVisible (hWnd=0x2021a) returned 0 [0089.693] IsWindowVisible (hWnd=0x8004a) returned 0 [0089.694] GetActiveWindow () returned 0x7002e [0089.694] GetFocus () returned 0x7002e [0089.694] MessageBoxW (hWnd=0x7002e, lpText="FZOVCRKWtP/CT6Deb8LvXw==", lpCaption="", uType=0x0) returned 1 [0089.695] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0089.695] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0089.696] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0089.696] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0089.696] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0089.697] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0089.703] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x5a020c) returned 0x1 [0089.704] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0089.704] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0089.889] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0089.896] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0089.896] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0089.896] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x5a020c) returned 0x1 [0089.898] SetFocus (hWnd=0x7002e) returned 0x5a020c [0089.899] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0089.901] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0089.901] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0089.901] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0089.901] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x5a020c, lParam=0x0) returned 0x0 [0089.905] IsWindow (hWnd=0x7002e) returned 1 [0089.906] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0089.906] IsWindow (hWnd=0x7002e) returned 1 [0089.906] SetFocus (hWnd=0x7002e) returned 0x7002e [0089.906] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0089.906] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0089.906] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0089.906] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x79 [0089.906] GetLastError () returned 0x0 [0089.906] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml", dwFileAttributes=0x80) returned 1 [0089.907] GetLastError () returned 0x0 [0089.907] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x79 [0089.907] GetLastError () returned 0x0 [0089.907] SetErrorMode (uMode=0x1) returned 0x0 [0089.907] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0089.907] GetLastError () returned 0x0 [0089.907] GetFileType (hFile=0x3f4) returned 0x1 [0089.907] SetErrorMode (uMode=0x0) returned 0x1 [0089.907] GetFileType (hFile=0x3f4) returned 0x1 [0089.908] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x8fe9a4 | out: lpFileSizeHigh=0x8fe9a4*=0x0) returned 0x689e [0089.908] GetLastError () returned 0x0 [0089.908] ReadFile (in: hFile=0x3f4, lpBuffer=0x2a3ece0, nNumberOfBytesToRead=0x689e, lpNumberOfBytesRead=0x8fe94c, lpOverlapped=0x0 | out: lpBuffer=0x2a3ece0*, lpNumberOfBytesRead=0x8fe94c*=0x689e, lpOverlapped=0x0) returned 1 [0089.909] GetLastError () returned 0x0 [0089.909] CloseHandle (hObject=0x3f4) returned 1 [0089.909] GetLastError () returned 0x0 [0089.909] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0089.909] GetLastError () returned 0x0 [0089.909] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8f4 | out: phKey=0x8fe8f4*=0x9f6560) returned 1 [0089.909] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0089.909] GetLastError () returned 0x0 [0089.910] CryptSetKeyParam (hKey=0x9f6560, dwParam=0x4, pbData=0x2a455f4*=0x1, dwFlags=0x0) returned 1 [0089.910] GetLastError () returned 0x0 [0089.910] CryptSetKeyParam (hKey=0x9f6560, dwParam=0x1, pbData=0x2a455c0, dwFlags=0x0) returned 1 [0089.910] GetLastError () returned 0x0 [0089.910] CryptEncrypt (in: hKey=0x9f6560, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2a45604*, pdwDataLen=0x8fe9ac*=0x68a0, dwBufLen=0x68a0 | out: pbData=0x2a45604*, pdwDataLen=0x8fe9ac*=0x68a0) returned 1 [0089.910] GetLastError () returned 0x0 [0089.910] CryptEncrypt (in: hKey=0x9f6560, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2a4bec4*, pdwDataLen=0x8fe9b4*=0x0, dwBufLen=0x10 | out: pbData=0x2a4bec4*, pdwDataLen=0x8fe9b4*=0x10) returned 1 [0089.910] GetLastError () returned 0x0 [0089.910] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x79 [0089.910] GetLastError () returned 0x0 [0089.910] SetErrorMode (uMode=0x1) returned 0x0 [0089.910] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0089.911] GetLastError () returned 0xb7 [0089.911] GetFileType (hFile=0x3f4) returned 0x1 [0089.911] SetErrorMode (uMode=0x0) returned 0x1 [0089.911] GetFileType (hFile=0x3f4) returned 0x1 [0089.911] WriteFile (in: hFile=0x3f4, lpBuffer=0x2a45604*, nNumberOfBytesToWrite=0x68a0, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2a45604*, lpNumberOfBytesWritten=0x8fe958*=0x68a0, lpOverlapped=0x0) returned 1 [0089.913] GetLastError () returned 0xb7 [0089.913] CloseHandle (hObject=0x3f4) returned 1 [0089.914] GetLastError () returned 0xb7 [0089.914] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml.FZOVCRKWtP#CT6Deb8LvXw==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml.FZOVCRKWtP#CT6Deb8LvXw==.bwall", lpFilePart=0x0) returned 0x98 [0089.914] GetLastError () returned 0xb7 [0089.914] SetErrorMode (uMode=0x1) returned 0x0 [0089.917] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml.FZOVCRKWtP#CT6Deb8LvXw==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml.fzovcrkwtp#ct6deb8lvxw==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0089.917] GetLastError () returned 0x0 [0089.917] GetFileType (hFile=0x3f4) returned 0x1 [0089.917] SetErrorMode (uMode=0x0) returned 0x1 [0089.917] GetFileType (hFile=0x3f4) returned 0x1 [0089.917] WriteFile (in: hFile=0x3f4, lpBuffer=0x2a45604*, nNumberOfBytesToWrite=0x68a0, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2a45604*, lpNumberOfBytesWritten=0x8fe958*=0x68a0, lpOverlapped=0x0) returned 1 [0089.919] GetLastError () returned 0x0 [0089.919] CloseHandle (hObject=0x3f4) returned 1 [0089.919] GetLastError () returned 0x0 [0089.919] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x79 [0089.919] GetLastError () returned 0x0 [0089.920] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml")) returned 1 [0089.921] GetLastError () returned 0x0 [0089.925] GetProcessWindowStation () returned 0x13c [0089.925] GetActiveWindow () returned 0x7002e [0089.925] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0089.925] GetCurrentThreadId () returned 0x540 [0089.926] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4dda, lParam=0x0) returned 1 [0089.926] IsWindowVisible (hWnd=0x7002e) returned 0 [0089.926] IsWindowVisible (hWnd=0x4020e) returned 0 [0089.926] IsWindowVisible (hWnd=0x60044) returned 0 [0089.926] IsWindowVisible (hWnd=0x2021a) returned 0 [0089.926] IsWindowVisible (hWnd=0x8004a) returned 0 [0089.926] GetActiveWindow () returned 0x7002e [0089.926] GetFocus () returned 0x7002e [0089.926] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0089.927] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0089.928] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0089.928] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0089.929] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0089.929] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0089.932] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0089.939] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x5b020c) returned 0x1 [0089.940] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0089.940] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0090.095] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0090.103] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0090.103] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0090.103] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x5b020c) returned 0x1 [0090.105] SetFocus (hWnd=0x7002e) returned 0x5b020c [0090.106] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0090.108] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0090.108] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0090.108] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0090.108] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x5b020c, lParam=0x0) returned 0x0 [0090.112] IsWindow (hWnd=0x7002e) returned 1 [0090.112] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0090.112] IsWindow (hWnd=0x7002e) returned 1 [0090.112] SetFocus (hWnd=0x7002e) returned 0x7002e [0090.113] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0090.113] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0090.113] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0090.113] GetProcessWindowStation () returned 0x13c [0090.113] GetActiveWindow () returned 0x7002e [0090.113] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0090.113] GetCurrentThreadId () returned 0x540 [0090.114] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4b3a, lParam=0x0) returned 1 [0090.114] IsWindowVisible (hWnd=0x7002e) returned 0 [0090.114] IsWindowVisible (hWnd=0x4020e) returned 0 [0090.114] IsWindowVisible (hWnd=0x60044) returned 0 [0090.114] IsWindowVisible (hWnd=0x2021a) returned 0 [0090.114] IsWindowVisible (hWnd=0x8004a) returned 0 [0090.114] GetActiveWindow () returned 0x7002e [0090.114] GetFocus () returned 0x7002e [0090.114] MessageBoxW (hWnd=0x7002e, lpText="8U3rUcsG5nZQzFyhS+Ayxg==", lpCaption="", uType=0x0) returned 1 [0090.115] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0090.116] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0090.116] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0090.117] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0090.117] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0090.117] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0090.126] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x5c020c) returned 0x1 [0090.127] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0090.127] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0090.297] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0090.304] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0090.304] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0090.304] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x5c020c) returned 0x1 [0090.305] SetFocus (hWnd=0x7002e) returned 0x5c020c [0090.307] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0090.308] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0090.308] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0090.309] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0090.309] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x5c020c, lParam=0x0) returned 0x0 [0090.313] IsWindow (hWnd=0x7002e) returned 1 [0090.313] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0090.313] IsWindow (hWnd=0x7002e) returned 1 [0090.313] SetFocus (hWnd=0x7002e) returned 0x7002e [0090.313] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0090.313] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0090.313] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0090.314] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x83 [0090.314] GetLastError () returned 0x0 [0090.314] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml", dwFileAttributes=0x80) returned 1 [0090.317] GetLastError () returned 0x0 [0090.317] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x83 [0090.317] GetLastError () returned 0x0 [0090.317] SetErrorMode (uMode=0x1) returned 0x0 [0090.317] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.project.project.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0090.317] GetLastError () returned 0x0 [0090.317] GetFileType (hFile=0x3f4) returned 0x1 [0090.317] SetErrorMode (uMode=0x0) returned 0x1 [0090.317] GetFileType (hFile=0x3f4) returned 0x1 [0090.317] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x8fe9a4 | out: lpFileSizeHigh=0x8fe9a4*=0x0) returned 0x7446 [0090.317] GetLastError () returned 0x0 [0090.318] ReadFile (in: hFile=0x3f4, lpBuffer=0x2a5152c, nNumberOfBytesToRead=0x7446, lpNumberOfBytesRead=0x8fe94c, lpOverlapped=0x0 | out: lpBuffer=0x2a5152c*, lpNumberOfBytesRead=0x8fe94c*=0x7446, lpOverlapped=0x0) returned 1 [0090.319] GetLastError () returned 0x0 [0090.319] CloseHandle (hObject=0x3f4) returned 1 [0090.319] GetLastError () returned 0x0 [0090.319] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0090.319] GetLastError () returned 0x0 [0090.319] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8f4 | out: phKey=0x8fe8f4*=0x9f65a0) returned 1 [0090.319] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0090.319] GetLastError () returned 0x0 [0090.319] CryptSetKeyParam (hKey=0x9f65a0, dwParam=0x4, pbData=0x2a589e8*=0x1, dwFlags=0x0) returned 1 [0090.319] GetLastError () returned 0x0 [0090.320] CryptSetKeyParam (hKey=0x9f65a0, dwParam=0x1, pbData=0x2a589b4, dwFlags=0x0) returned 1 [0090.320] GetLastError () returned 0x0 [0090.320] CryptEncrypt (in: hKey=0x9f65a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2a589f8*, pdwDataLen=0x8fe9ac*=0x7450, dwBufLen=0x7450 | out: pbData=0x2a589f8*, pdwDataLen=0x8fe9ac*=0x7450) returned 1 [0090.320] GetLastError () returned 0x0 [0090.320] CryptEncrypt (in: hKey=0x9f65a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2a5fe68*, pdwDataLen=0x8fe9b4*=0x0, dwBufLen=0x10 | out: pbData=0x2a5fe68*, pdwDataLen=0x8fe9b4*=0x10) returned 1 [0090.320] GetLastError () returned 0x0 [0090.320] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x83 [0090.320] GetLastError () returned 0x0 [0090.320] SetErrorMode (uMode=0x1) returned 0x0 [0090.320] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.project.project.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0090.324] GetLastError () returned 0xb7 [0090.324] GetFileType (hFile=0x3f4) returned 0x1 [0090.324] SetErrorMode (uMode=0x0) returned 0x1 [0090.325] GetFileType (hFile=0x3f4) returned 0x1 [0090.325] WriteFile (in: hFile=0x3f4, lpBuffer=0x2a589f8*, nNumberOfBytesToWrite=0x7450, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2a589f8*, lpNumberOfBytesWritten=0x8fe958*=0x7450, lpOverlapped=0x0) returned 1 [0090.326] GetLastError () returned 0xb7 [0090.326] CloseHandle (hObject=0x3f4) returned 1 [0090.328] GetLastError () returned 0xb7 [0090.328] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml.8U3rUcsG5nZQzFyhS+Ayxg==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml.8U3rUcsG5nZQzFyhS+Ayxg==.bwall", lpFilePart=0x0) returned 0xa2 [0090.328] GetLastError () returned 0xb7 [0090.328] SetErrorMode (uMode=0x1) returned 0x0 [0090.328] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml.8U3rUcsG5nZQzFyhS+Ayxg==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.project.project.x-none.msi.16.x-none.xml.8u3rucsg5nzqzfyhs+ayxg==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0090.328] GetLastError () returned 0x0 [0090.328] GetFileType (hFile=0x3f4) returned 0x1 [0090.328] SetErrorMode (uMode=0x0) returned 0x1 [0090.328] GetFileType (hFile=0x3f4) returned 0x1 [0090.328] WriteFile (in: hFile=0x3f4, lpBuffer=0x2a589f8*, nNumberOfBytesToWrite=0x7450, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2a589f8*, lpNumberOfBytesWritten=0x8fe958*=0x7450, lpOverlapped=0x0) returned 1 [0090.330] GetLastError () returned 0x0 [0090.330] CloseHandle (hObject=0x3f4) returned 1 [0090.330] GetLastError () returned 0x0 [0090.331] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x83 [0090.331] GetLastError () returned 0x0 [0090.331] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.project.project.x-none.msi.16.x-none.xml")) returned 1 [0090.332] GetLastError () returned 0x0 [0090.332] GetProcessWindowStation () returned 0x13c [0090.332] GetActiveWindow () returned 0x7002e [0090.332] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0090.332] GetCurrentThreadId () returned 0x540 [0090.332] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4daa, lParam=0x0) returned 1 [0090.333] IsWindowVisible (hWnd=0x7002e) returned 0 [0090.333] IsWindowVisible (hWnd=0x4020e) returned 0 [0090.333] IsWindowVisible (hWnd=0x60044) returned 0 [0090.333] IsWindowVisible (hWnd=0x2021a) returned 0 [0090.333] IsWindowVisible (hWnd=0x8004a) returned 0 [0090.333] GetActiveWindow () returned 0x7002e [0090.333] GetFocus () returned 0x7002e [0090.333] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0090.334] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0090.334] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0090.335] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0090.335] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0090.335] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0090.340] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0090.346] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x5d020c) returned 0x1 [0090.347] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0090.347] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0090.511] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0090.518] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0090.519] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0090.519] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x5d020c) returned 0x1 [0090.520] SetFocus (hWnd=0x7002e) returned 0x5d020c [0090.522] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0090.523] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0090.523] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0090.523] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0090.523] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x5d020c, lParam=0x0) returned 0x0 [0090.533] IsWindow (hWnd=0x7002e) returned 1 [0090.533] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0090.533] IsWindow (hWnd=0x7002e) returned 1 [0090.533] SetFocus (hWnd=0x7002e) returned 0x7002e [0090.534] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0090.534] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0090.534] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0090.534] GetProcessWindowStation () returned 0x13c [0090.534] GetActiveWindow () returned 0x7002e [0090.534] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0090.534] GetCurrentThreadId () returned 0x540 [0090.534] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4f2a, lParam=0x0) returned 1 [0090.535] IsWindowVisible (hWnd=0x7002e) returned 0 [0090.535] IsWindowVisible (hWnd=0x4020e) returned 0 [0090.535] IsWindowVisible (hWnd=0x60044) returned 0 [0090.535] IsWindowVisible (hWnd=0x2021a) returned 0 [0090.535] IsWindowVisible (hWnd=0x8004a) returned 0 [0090.535] GetActiveWindow () returned 0x7002e [0090.535] GetFocus () returned 0x7002e [0090.535] MessageBoxW (hWnd=0x7002e, lpText="WKiyAWAi1tFV+JEAuspvbQ==", lpCaption="", uType=0x0) returned 1 [0090.536] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0090.537] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0090.537] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0090.538] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0090.538] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0090.538] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0090.547] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x5e020c) returned 0x1 [0090.548] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0090.548] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0090.702] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0090.709] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0090.709] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0090.709] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x5e020c) returned 0x1 [0090.711] SetFocus (hWnd=0x7002e) returned 0x5e020c [0090.712] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0090.714] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0090.714] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0090.714] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0090.714] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x5e020c, lParam=0x0) returned 0x0 [0090.718] IsWindow (hWnd=0x7002e) returned 1 [0090.718] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0090.719] IsWindow (hWnd=0x7002e) returned 1 [0090.719] SetFocus (hWnd=0x7002e) returned 0x7002e [0090.719] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0090.719] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0090.719] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0090.719] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x76 [0090.719] GetLastError () returned 0x0 [0090.719] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml", dwFileAttributes=0x80) returned 1 [0090.719] GetLastError () returned 0x0 [0090.719] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x76 [0090.719] GetLastError () returned 0x0 [0090.720] SetErrorMode (uMode=0x1) returned 0x0 [0090.720] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.projectmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0090.720] GetLastError () returned 0x0 [0090.720] GetFileType (hFile=0x3f4) returned 0x1 [0090.720] SetErrorMode (uMode=0x0) returned 0x1 [0090.720] GetFileType (hFile=0x3f4) returned 0x1 [0090.720] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x8fe9a4 | out: lpFileSizeHigh=0x8fe9a4*=0x0) returned 0x809e [0090.720] GetLastError () returned 0x0 [0090.720] ReadFile (in: hFile=0x3f4, lpBuffer=0x2a654b8, nNumberOfBytesToRead=0x809e, lpNumberOfBytesRead=0x8fe94c, lpOverlapped=0x0 | out: lpBuffer=0x2a654b8*, lpNumberOfBytesRead=0x8fe94c*=0x809e, lpOverlapped=0x0) returned 1 [0090.722] GetLastError () returned 0x0 [0090.722] CloseHandle (hObject=0x3f4) returned 1 [0090.722] GetLastError () returned 0x0 [0090.722] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0090.722] GetLastError () returned 0x0 [0090.722] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8f4 | out: phKey=0x8fe8f4*=0x9f63a0) returned 1 [0090.722] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0090.722] GetLastError () returned 0x0 [0090.722] CryptSetKeyParam (hKey=0x9f63a0, dwParam=0x4, pbData=0x2a6d5cc*=0x1, dwFlags=0x0) returned 1 [0090.722] GetLastError () returned 0x0 [0090.722] CryptSetKeyParam (hKey=0x9f63a0, dwParam=0x1, pbData=0x2a6d598, dwFlags=0x0) returned 1 [0090.722] GetLastError () returned 0x0 [0090.722] CryptEncrypt (in: hKey=0x9f63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2a6d5dc*, pdwDataLen=0x8fe9ac*=0x80a0, dwBufLen=0x80a0 | out: pbData=0x2a6d5dc*, pdwDataLen=0x8fe9ac*=0x80a0) returned 1 [0090.722] GetLastError () returned 0x0 [0090.722] CryptEncrypt (in: hKey=0x9f63a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2a7569c*, pdwDataLen=0x8fe9b4*=0x0, dwBufLen=0x10 | out: pbData=0x2a7569c*, pdwDataLen=0x8fe9b4*=0x10) returned 1 [0090.723] GetLastError () returned 0x0 [0090.723] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x76 [0090.723] GetLastError () returned 0x0 [0090.723] SetErrorMode (uMode=0x1) returned 0x0 [0090.723] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.projectmui.msi.16.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0090.724] GetLastError () returned 0xb7 [0090.724] GetFileType (hFile=0x3f4) returned 0x1 [0090.724] SetErrorMode (uMode=0x0) returned 0x1 [0090.724] GetFileType (hFile=0x3f4) returned 0x1 [0090.724] WriteFile (in: hFile=0x3f4, lpBuffer=0x2a6d5dc*, nNumberOfBytesToWrite=0x80a0, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2a6d5dc*, lpNumberOfBytesWritten=0x8fe958*=0x80a0, lpOverlapped=0x0) returned 1 [0090.725] GetLastError () returned 0xb7 [0090.725] CloseHandle (hObject=0x3f4) returned 1 [0090.730] GetLastError () returned 0xb7 [0090.730] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml.WKiyAWAi1tFV+JEAuspvbQ==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml.WKiyAWAi1tFV+JEAuspvbQ==.bwall", lpFilePart=0x0) returned 0x95 [0090.730] GetLastError () returned 0xb7 [0090.730] SetErrorMode (uMode=0x1) returned 0x0 [0090.730] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml.WKiyAWAi1tFV+JEAuspvbQ==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.projectmui.msi.16.en-us.xml.wkiyawai1tfv+jeauspvbq==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0090.730] GetLastError () returned 0x0 [0090.730] GetFileType (hFile=0x3f4) returned 0x1 [0090.731] SetErrorMode (uMode=0x0) returned 0x1 [0090.731] GetFileType (hFile=0x3f4) returned 0x1 [0090.731] WriteFile (in: hFile=0x3f4, lpBuffer=0x2a6d5dc*, nNumberOfBytesToWrite=0x80a0, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2a6d5dc*, lpNumberOfBytesWritten=0x8fe958*=0x80a0, lpOverlapped=0x0) returned 1 [0090.732] GetLastError () returned 0x0 [0090.732] CloseHandle (hObject=0x3f4) returned 1 [0090.733] GetLastError () returned 0x0 [0090.733] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x76 [0090.733] GetLastError () returned 0x0 [0090.733] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.projectmui.msi.16.en-us.xml")) returned 1 [0090.734] GetLastError () returned 0x0 [0090.734] GetProcessWindowStation () returned 0x13c [0090.734] GetActiveWindow () returned 0x7002e [0090.734] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0090.734] GetCurrentThreadId () returned 0x540 [0090.735] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4cea, lParam=0x0) returned 1 [0090.735] IsWindowVisible (hWnd=0x7002e) returned 0 [0090.735] IsWindowVisible (hWnd=0x4020e) returned 0 [0090.735] IsWindowVisible (hWnd=0x60044) returned 0 [0090.735] IsWindowVisible (hWnd=0x2021a) returned 0 [0090.735] IsWindowVisible (hWnd=0x8004a) returned 0 [0090.735] GetActiveWindow () returned 0x7002e [0090.735] GetFocus () returned 0x7002e [0090.735] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0090.736] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0090.737] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0090.737] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0090.738] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0090.738] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0090.741] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0090.748] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x5f020c) returned 0x1 [0090.749] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0090.749] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0090.905] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0090.912] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0090.912] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0090.913] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x5f020c) returned 0x1 [0090.914] SetFocus (hWnd=0x7002e) returned 0x5f020c [0090.916] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0090.917] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0090.917] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0090.917] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0090.918] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x5f020c, lParam=0x0) returned 0x0 [0090.922] IsWindow (hWnd=0x7002e) returned 1 [0090.922] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0090.922] IsWindow (hWnd=0x7002e) returned 1 [0090.922] SetFocus (hWnd=0x7002e) returned 0x7002e [0090.922] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0090.922] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0090.922] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0090.922] GetProcessWindowStation () returned 0x13c [0090.922] GetActiveWindow () returned 0x7002e [0090.922] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0090.923] GetCurrentThreadId () returned 0x540 [0090.923] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4e0a, lParam=0x0) returned 1 [0090.923] IsWindowVisible (hWnd=0x7002e) returned 0 [0090.923] IsWindowVisible (hWnd=0x4020e) returned 0 [0090.923] IsWindowVisible (hWnd=0x60044) returned 0 [0090.923] IsWindowVisible (hWnd=0x2021a) returned 0 [0090.923] IsWindowVisible (hWnd=0x8004a) returned 0 [0090.923] GetActiveWindow () returned 0x7002e [0090.923] GetFocus () returned 0x7002e [0090.923] MessageBoxW (hWnd=0x7002e, lpText="fp+Nk3VSMfKkivZsvcw58w==", lpCaption="", uType=0x0) returned 1 [0090.924] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0090.925] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0090.925] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0090.926] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0090.926] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0090.926] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0090.935] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x60020c) returned 0x1 [0090.936] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0090.936] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0091.108] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0091.115] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0091.115] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0091.115] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x60020c) returned 0x1 [0091.117] SetFocus (hWnd=0x7002e) returned 0x60020c [0091.119] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0091.121] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0091.121] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0091.121] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0091.121] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x60020c, lParam=0x0) returned 0x0 [0091.125] IsWindow (hWnd=0x7002e) returned 1 [0091.125] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0091.125] IsWindow (hWnd=0x7002e) returned 1 [0091.125] SetFocus (hWnd=0x7002e) returned 0x7002e [0091.125] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0091.125] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0091.125] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0091.125] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml", lpFilePart=0x0) returned 0x79 [0091.126] GetLastError () returned 0x0 [0091.126] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml", dwFileAttributes=0x80) returned 1 [0091.132] GetLastError () returned 0x0 [0091.132] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml", lpFilePart=0x0) returned 0x79 [0091.132] GetLastError () returned 0x0 [0091.132] SetErrorMode (uMode=0x1) returned 0x0 [0091.132] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0091.133] GetLastError () returned 0x0 [0091.133] GetFileType (hFile=0x3f4) returned 0x1 [0091.133] SetErrorMode (uMode=0x0) returned 0x1 [0091.133] GetFileType (hFile=0x3f4) returned 0x1 [0091.133] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x8fe9a4 | out: lpFileSizeHigh=0x8fe9a4*=0x0) returned 0x63ae [0091.133] GetLastError () returned 0x0 [0091.133] ReadFile (in: hFile=0x3f4, lpBuffer=0x2a7ac64, nNumberOfBytesToRead=0x63ae, lpNumberOfBytesRead=0x8fe94c, lpOverlapped=0x0 | out: lpBuffer=0x2a7ac64*, lpNumberOfBytesRead=0x8fe94c*=0x63ae, lpOverlapped=0x0) returned 1 [0091.137] GetLastError () returned 0x0 [0091.137] CloseHandle (hObject=0x3f4) returned 1 [0091.137] GetLastError () returned 0x0 [0091.137] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0091.137] GetLastError () returned 0x0 [0091.138] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8f4 | out: phKey=0x8fe8f4*=0x9f61e0) returned 1 [0091.138] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0091.138] GetLastError () returned 0x0 [0091.138] CryptSetKeyParam (hKey=0x9f61e0, dwParam=0x4, pbData=0x2a81088*=0x1, dwFlags=0x0) returned 1 [0091.138] GetLastError () returned 0x0 [0091.138] CryptSetKeyParam (hKey=0x9f61e0, dwParam=0x1, pbData=0x2a81054, dwFlags=0x0) returned 1 [0091.138] GetLastError () returned 0x0 [0091.138] CryptEncrypt (in: hKey=0x9f61e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2a81098*, pdwDataLen=0x8fe9ac*=0x63b0, dwBufLen=0x63b0 | out: pbData=0x2a81098*, pdwDataLen=0x8fe9ac*=0x63b0) returned 1 [0091.138] GetLastError () returned 0x0 [0091.138] CryptEncrypt (in: hKey=0x9f61e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2a87468*, pdwDataLen=0x8fe9b4*=0x0, dwBufLen=0x10 | out: pbData=0x2a87468*, pdwDataLen=0x8fe9b4*=0x10) returned 1 [0091.138] GetLastError () returned 0x0 [0091.138] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml", lpFilePart=0x0) returned 0x79 [0091.138] GetLastError () returned 0x0 [0091.138] SetErrorMode (uMode=0x1) returned 0x0 [0091.138] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0091.140] GetLastError () returned 0xb7 [0091.140] GetFileType (hFile=0x3f4) returned 0x1 [0091.140] SetErrorMode (uMode=0x0) returned 0x1 [0091.140] GetFileType (hFile=0x3f4) returned 0x1 [0091.140] WriteFile (in: hFile=0x3f4, lpBuffer=0x2a81098*, nNumberOfBytesToWrite=0x63b0, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2a81098*, lpNumberOfBytesWritten=0x8fe958*=0x63b0, lpOverlapped=0x0) returned 1 [0091.141] GetLastError () returned 0xb7 [0091.141] CloseHandle (hObject=0x3f4) returned 1 [0091.142] GetLastError () returned 0xb7 [0091.142] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml.fp+Nk3VSMfKkivZsvcw58w==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml.fp+Nk3VSMfKkivZsvcw58w==.bwall", lpFilePart=0x0) returned 0x98 [0091.142] GetLastError () returned 0xb7 [0091.142] SetErrorMode (uMode=0x1) returned 0x0 [0091.143] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml.fp+Nk3VSMfKkivZsvcw58w==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml.fp+nk3vsmfkkivzsvcw58w==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0091.143] GetLastError () returned 0x0 [0091.143] GetFileType (hFile=0x3f4) returned 0x1 [0091.144] SetErrorMode (uMode=0x0) returned 0x1 [0091.144] GetFileType (hFile=0x3f4) returned 0x1 [0091.144] WriteFile (in: hFile=0x3f4, lpBuffer=0x2a81098*, nNumberOfBytesToWrite=0x63b0, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2a81098*, lpNumberOfBytesWritten=0x8fe958*=0x63b0, lpOverlapped=0x0) returned 1 [0091.145] GetLastError () returned 0x0 [0091.145] CloseHandle (hObject=0x3f4) returned 1 [0091.146] GetLastError () returned 0x0 [0091.146] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml", lpFilePart=0x0) returned 0x79 [0091.146] GetLastError () returned 0x0 [0091.146] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml")) returned 1 [0091.147] GetLastError () returned 0x0 [0091.147] GetProcessWindowStation () returned 0x13c [0091.147] GetActiveWindow () returned 0x7002e [0091.147] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0091.147] GetCurrentThreadId () returned 0x540 [0091.148] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4fba, lParam=0x0) returned 1 [0091.148] IsWindowVisible (hWnd=0x7002e) returned 0 [0091.148] IsWindowVisible (hWnd=0x4020e) returned 0 [0091.148] IsWindowVisible (hWnd=0x60044) returned 0 [0091.148] IsWindowVisible (hWnd=0x2021a) returned 0 [0091.148] IsWindowVisible (hWnd=0x8004a) returned 0 [0091.148] GetActiveWindow () returned 0x7002e [0091.148] GetFocus () returned 0x7002e [0091.148] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0091.152] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0091.154] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0091.155] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0091.155] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0091.155] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0091.155] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0091.162] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x61020c) returned 0x1 [0091.163] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0091.163] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0091.311] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0091.320] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0091.320] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0091.320] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x61020c) returned 0x1 [0091.321] SetFocus (hWnd=0x7002e) returned 0x61020c [0091.323] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0091.324] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0091.325] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0091.325] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0091.325] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x61020c, lParam=0x0) returned 0x0 [0091.329] IsWindow (hWnd=0x7002e) returned 1 [0091.329] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0091.329] IsWindow (hWnd=0x7002e) returned 1 [0091.329] SetFocus (hWnd=0x7002e) returned 0x7002e [0091.329] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0091.330] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0091.330] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0091.330] GetProcessWindowStation () returned 0x13c [0091.330] GetActiveWindow () returned 0x7002e [0091.330] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0091.330] GetCurrentThreadId () returned 0x540 [0091.330] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4f8a, lParam=0x0) returned 1 [0091.330] IsWindowVisible (hWnd=0x7002e) returned 0 [0091.331] IsWindowVisible (hWnd=0x4020e) returned 0 [0091.331] IsWindowVisible (hWnd=0x60044) returned 0 [0091.331] IsWindowVisible (hWnd=0x2021a) returned 0 [0091.331] IsWindowVisible (hWnd=0x8004a) returned 0 [0091.331] GetActiveWindow () returned 0x7002e [0091.331] GetFocus () returned 0x7002e [0091.331] MessageBoxW (hWnd=0x7002e, lpText="ZD5F20moI2Viumn4dikMZg==", lpCaption="", uType=0x0) returned 1 [0091.332] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0091.332] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0091.333] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0091.333] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0091.333] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0091.334] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0091.342] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x62020c) returned 0x1 [0091.343] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0091.343] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0091.678] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0091.687] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0091.687] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0091.687] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x62020c) returned 0x1 [0091.688] SetFocus (hWnd=0x7002e) returned 0x62020c [0091.690] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0091.691] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0091.692] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0091.692] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0091.692] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x62020c, lParam=0x0) returned 0x0 [0091.697] IsWindow (hWnd=0x7002e) returned 1 [0091.697] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0091.697] IsWindow (hWnd=0x7002e) returned 1 [0091.697] SetFocus (hWnd=0x7002e) returned 0x7002e [0091.697] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0091.697] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0091.697] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0091.697] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml", lpFilePart=0x0) returned 0x79 [0091.697] GetLastError () returned 0x0 [0091.697] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml", dwFileAttributes=0x80) returned 1 [0091.698] GetLastError () returned 0x0 [0091.698] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml", lpFilePart=0x0) returned 0x79 [0091.698] GetLastError () returned 0x0 [0091.698] SetErrorMode (uMode=0x1) returned 0x0 [0091.699] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0091.699] GetLastError () returned 0x0 [0091.699] GetFileType (hFile=0x3f4) returned 0x1 [0091.699] SetErrorMode (uMode=0x0) returned 0x1 [0091.699] GetFileType (hFile=0x3f4) returned 0x1 [0091.699] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x8fe9a4 | out: lpFileSizeHigh=0x8fe9a4*=0x0) returned 0x5fee [0091.699] GetLastError () returned 0x0 [0091.699] ReadFile (in: hFile=0x3f4, lpBuffer=0x2a8ca50, nNumberOfBytesToRead=0x5fee, lpNumberOfBytesRead=0x8fe94c, lpOverlapped=0x0 | out: lpBuffer=0x2a8ca50*, lpNumberOfBytesRead=0x8fe94c*=0x5fee, lpOverlapped=0x0) returned 1 [0091.700] GetLastError () returned 0x0 [0091.700] CloseHandle (hObject=0x3f4) returned 1 [0091.701] GetLastError () returned 0x0 [0091.701] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0091.701] GetLastError () returned 0x0 [0091.701] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8f4 | out: phKey=0x8fe8f4*=0x9f65e0) returned 1 [0091.701] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0091.701] GetLastError () returned 0x0 [0091.701] CryptSetKeyParam (hKey=0x9f65e0, dwParam=0x4, pbData=0x2a92ab4*=0x1, dwFlags=0x0) returned 1 [0091.701] GetLastError () returned 0x0 [0091.701] CryptSetKeyParam (hKey=0x9f65e0, dwParam=0x1, pbData=0x2a92a80, dwFlags=0x0) returned 1 [0091.701] GetLastError () returned 0x0 [0091.701] CryptEncrypt (in: hKey=0x9f65e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2a92ac4*, pdwDataLen=0x8fe9ac*=0x5ff0, dwBufLen=0x5ff0 | out: pbData=0x2a92ac4*, pdwDataLen=0x8fe9ac*=0x5ff0) returned 1 [0091.701] GetLastError () returned 0x0 [0091.701] CryptEncrypt (in: hKey=0x9f65e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2a98ad4*, pdwDataLen=0x8fe9b4*=0x0, dwBufLen=0x10 | out: pbData=0x2a98ad4*, pdwDataLen=0x8fe9b4*=0x10) returned 1 [0091.701] GetLastError () returned 0x0 [0091.701] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml", lpFilePart=0x0) returned 0x79 [0091.701] GetLastError () returned 0x0 [0091.702] SetErrorMode (uMode=0x1) returned 0x0 [0091.702] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0091.703] GetLastError () returned 0xb7 [0091.703] GetFileType (hFile=0x3f4) returned 0x1 [0091.703] SetErrorMode (uMode=0x0) returned 0x1 [0091.703] GetFileType (hFile=0x3f4) returned 0x1 [0091.703] WriteFile (in: hFile=0x3f4, lpBuffer=0x2a92ac4*, nNumberOfBytesToWrite=0x5ff0, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2a92ac4*, lpNumberOfBytesWritten=0x8fe958*=0x5ff0, lpOverlapped=0x0) returned 1 [0091.704] GetLastError () returned 0xb7 [0091.704] CloseHandle (hObject=0x3f4) returned 1 [0091.705] GetLastError () returned 0xb7 [0091.705] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml.ZD5F20moI2Viumn4dikMZg==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml.ZD5F20moI2Viumn4dikMZg==.bwall", lpFilePart=0x0) returned 0x98 [0091.705] GetLastError () returned 0xb7 [0091.705] SetErrorMode (uMode=0x1) returned 0x0 [0091.706] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml.ZD5F20moI2Viumn4dikMZg==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml.zd5f20moi2viumn4dikmzg==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0091.706] GetLastError () returned 0x0 [0091.706] GetFileType (hFile=0x3f4) returned 0x1 [0091.706] SetErrorMode (uMode=0x0) returned 0x1 [0091.706] GetFileType (hFile=0x3f4) returned 0x1 [0091.706] WriteFile (in: hFile=0x3f4, lpBuffer=0x2a92ac4*, nNumberOfBytesToWrite=0x5ff0, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2a92ac4*, lpNumberOfBytesWritten=0x8fe958*=0x5ff0, lpOverlapped=0x0) returned 1 [0091.707] GetLastError () returned 0x0 [0091.707] CloseHandle (hObject=0x3f4) returned 1 [0091.708] GetLastError () returned 0x0 [0091.708] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml", nBufferLength=0x105, lpBuffer=0x8fe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml", lpFilePart=0x0) returned 0x79 [0091.708] GetLastError () returned 0x0 [0091.708] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml")) returned 1 [0091.709] GetLastError () returned 0x0 [0091.709] GetProcessWindowStation () returned 0x13c [0091.709] GetActiveWindow () returned 0x7002e [0091.709] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0091.709] GetCurrentThreadId () returned 0x540 [0091.710] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4b6a, lParam=0x0) returned 1 [0091.710] IsWindowVisible (hWnd=0x7002e) returned 0 [0091.710] IsWindowVisible (hWnd=0x4020e) returned 0 [0091.710] IsWindowVisible (hWnd=0x60044) returned 0 [0091.710] IsWindowVisible (hWnd=0x2021a) returned 0 [0091.710] IsWindowVisible (hWnd=0x8004a) returned 0 [0091.710] GetActiveWindow () returned 0x7002e [0091.710] GetFocus () returned 0x7002e [0091.710] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0091.720] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0091.722] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0091.723] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0091.723] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0091.723] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0091.724] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0091.731] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x63020c) returned 0x1 [0091.732] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0091.732] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0091.986] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0091.997] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0091.997] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0091.997] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x63020c) returned 0x1 [0091.999] SetFocus (hWnd=0x7002e) returned 0x63020c [0092.000] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0092.002] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0092.002] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0092.002] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0092.002] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x63020c, lParam=0x0) returned 0x0 [0092.007] IsWindow (hWnd=0x7002e) returned 1 [0092.007] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0092.007] IsWindow (hWnd=0x7002e) returned 1 [0092.007] SetFocus (hWnd=0x7002e) returned 0x7002e [0092.007] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0092.007] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0092.007] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0092.008] GetProcessWindowStation () returned 0x13c [0092.008] GetActiveWindow () returned 0x7002e [0092.008] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0092.008] GetCurrentThreadId () returned 0x540 [0092.011] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4e6a, lParam=0x0) returned 1 [0092.011] IsWindowVisible (hWnd=0x7002e) returned 0 [0092.011] IsWindowVisible (hWnd=0x4020e) returned 0 [0092.011] IsWindowVisible (hWnd=0x60044) returned 0 [0092.011] IsWindowVisible (hWnd=0x2021a) returned 0 [0092.011] IsWindowVisible (hWnd=0x8004a) returned 0 [0092.011] GetActiveWindow () returned 0x7002e [0092.011] GetFocus () returned 0x7002e [0092.011] MessageBoxW (hWnd=0x7002e, lpText="UojXTGEJE/9/o22FD2dh0g==", lpCaption="", uType=0x0) returned 1 [0092.013] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0092.013] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0092.014] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0092.014] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0092.014] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0092.014] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0092.021] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x64020c) returned 0x1 [0092.022] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0092.022] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0092.129] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0092.140] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0092.140] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0092.140] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x64020c) returned 0x1 [0092.141] SetFocus (hWnd=0x7002e) returned 0x64020c [0092.143] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0092.144] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0092.145] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0092.145] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0092.145] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x64020c, lParam=0x0) returned 0x0 [0092.151] IsWindow (hWnd=0x7002e) returned 1 [0092.151] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0092.151] IsWindow (hWnd=0x7002e) returned 1 [0092.152] SetFocus (hWnd=0x7002e) returned 0x7002e [0092.152] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0092.152] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0092.152] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0092.152] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml", lpFilePart=0x0) returned 0x79 [0092.152] GetLastError () returned 0x0 [0092.152] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml", dwFileAttributes=0x80) returned 1 [0092.153] GetLastError () returned 0x0 [0092.153] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml", lpFilePart=0x0) returned 0x79 [0092.153] GetLastError () returned 0x0 [0092.153] SetErrorMode (uMode=0x1) returned 0x0 [0092.153] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0092.153] GetLastError () returned 0x0 [0092.153] GetFileType (hFile=0x3f4) returned 0x1 [0092.153] SetErrorMode (uMode=0x0) returned 0x1 [0092.153] GetFileType (hFile=0x3f4) returned 0x1 [0092.153] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x8fe9a4 | out: lpFileSizeHigh=0x8fe9a4*=0x0) returned 0x5fee [0092.153] GetLastError () returned 0x0 [0092.153] ReadFile (in: hFile=0x3f4, lpBuffer=0x2a9e0bc, nNumberOfBytesToRead=0x5fee, lpNumberOfBytesRead=0x8fe94c, lpOverlapped=0x0 | out: lpBuffer=0x2a9e0bc*, lpNumberOfBytesRead=0x8fe94c*=0x5fee, lpOverlapped=0x0) returned 1 [0092.154] GetLastError () returned 0x0 [0092.155] CloseHandle (hObject=0x3f4) returned 1 [0092.155] GetLastError () returned 0x0 [0092.155] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0092.155] GetLastError () returned 0x0 [0092.155] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8f4 | out: phKey=0x8fe8f4*=0x9f6620) returned 1 [0092.155] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0092.155] GetLastError () returned 0x0 [0092.155] CryptSetKeyParam (hKey=0x9f6620, dwParam=0x4, pbData=0x2aa4120*=0x1, dwFlags=0x0) returned 1 [0092.155] GetLastError () returned 0x0 [0092.155] CryptSetKeyParam (hKey=0x9f6620, dwParam=0x1, pbData=0x2aa40ec, dwFlags=0x0) returned 1 [0092.155] GetLastError () returned 0x0 [0092.155] CryptEncrypt (in: hKey=0x9f6620, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2aa4130*, pdwDataLen=0x8fe9ac*=0x5ff0, dwBufLen=0x5ff0 | out: pbData=0x2aa4130*, pdwDataLen=0x8fe9ac*=0x5ff0) returned 1 [0092.155] GetLastError () returned 0x0 [0092.155] CryptEncrypt (in: hKey=0x9f6620, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2aaa140*, pdwDataLen=0x8fe9b4*=0x0, dwBufLen=0x10 | out: pbData=0x2aaa140*, pdwDataLen=0x8fe9b4*=0x10) returned 1 [0092.155] GetLastError () returned 0x0 [0092.156] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml", lpFilePart=0x0) returned 0x79 [0092.156] GetLastError () returned 0x0 [0092.156] SetErrorMode (uMode=0x1) returned 0x0 [0092.156] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0092.157] GetLastError () returned 0xb7 [0092.157] GetFileType (hFile=0x3f4) returned 0x1 [0092.157] SetErrorMode (uMode=0x0) returned 0x1 [0092.157] GetFileType (hFile=0x3f4) returned 0x1 [0092.157] WriteFile (in: hFile=0x3f4, lpBuffer=0x2aa4130*, nNumberOfBytesToWrite=0x5ff0, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2aa4130*, lpNumberOfBytesWritten=0x8fe958*=0x5ff0, lpOverlapped=0x0) returned 1 [0092.158] GetLastError () returned 0xb7 [0092.158] CloseHandle (hObject=0x3f4) returned 1 [0092.159] GetLastError () returned 0xb7 [0092.159] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.UojXTGEJE#9#o22FD2dh0g==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.UojXTGEJE#9#o22FD2dh0g==.bwall", lpFilePart=0x0) returned 0x98 [0092.159] GetLastError () returned 0xb7 [0092.159] SetErrorMode (uMode=0x1) returned 0x0 [0092.160] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.UojXTGEJE#9#o22FD2dh0g==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml.uojxtgeje#9#o22fd2dh0g==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0092.161] GetLastError () returned 0x0 [0092.161] GetFileType (hFile=0x3f4) returned 0x1 [0092.161] SetErrorMode (uMode=0x0) returned 0x1 [0092.161] GetFileType (hFile=0x3f4) returned 0x1 [0092.161] WriteFile (in: hFile=0x3f4, lpBuffer=0x2aa4130*, nNumberOfBytesToWrite=0x5ff0, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2aa4130*, lpNumberOfBytesWritten=0x8fe958*=0x5ff0, lpOverlapped=0x0) returned 1 [0092.162] GetLastError () returned 0x0 [0092.162] CloseHandle (hObject=0x3f4) returned 1 [0092.163] GetLastError () returned 0x0 [0092.163] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml", nBufferLength=0x105, lpBuffer=0x8fe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml", lpFilePart=0x0) returned 0x79 [0092.163] GetLastError () returned 0x0 [0092.163] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml")) returned 1 [0092.164] GetLastError () returned 0x0 [0092.164] GetProcessWindowStation () returned 0x13c [0092.166] GetActiveWindow () returned 0x7002e [0092.166] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0092.167] GetCurrentThreadId () returned 0x540 [0092.167] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4eca, lParam=0x0) returned 1 [0092.167] IsWindowVisible (hWnd=0x7002e) returned 0 [0092.167] IsWindowVisible (hWnd=0x4020e) returned 0 [0092.167] IsWindowVisible (hWnd=0x60044) returned 0 [0092.167] IsWindowVisible (hWnd=0x2021a) returned 0 [0092.167] IsWindowVisible (hWnd=0x8004a) returned 0 [0092.167] GetActiveWindow () returned 0x7002e [0092.167] GetFocus () returned 0x7002e [0092.168] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0092.168] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0092.169] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0092.170] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0092.170] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0092.170] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0092.170] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0092.177] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x65020c) returned 0x1 [0092.177] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0092.178] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0092.528] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0092.535] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0092.535] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0092.535] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x65020c) returned 0x1 [0092.537] SetFocus (hWnd=0x7002e) returned 0x65020c [0092.538] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0092.543] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0092.544] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0092.544] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0092.544] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x65020c, lParam=0x0) returned 0x0 [0092.548] IsWindow (hWnd=0x7002e) returned 1 [0092.548] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0092.548] IsWindow (hWnd=0x7002e) returned 1 [0092.548] SetFocus (hWnd=0x7002e) returned 0x7002e [0092.548] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0092.548] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0092.548] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0092.549] GetProcessWindowStation () returned 0x13c [0092.549] GetActiveWindow () returned 0x7002e [0092.549] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0092.549] GetCurrentThreadId () returned 0x540 [0092.549] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4d1a, lParam=0x0) returned 1 [0092.549] IsWindowVisible (hWnd=0x7002e) returned 0 [0092.549] IsWindowVisible (hWnd=0x4020e) returned 0 [0092.550] IsWindowVisible (hWnd=0x60044) returned 0 [0092.550] IsWindowVisible (hWnd=0x2021a) returned 0 [0092.550] IsWindowVisible (hWnd=0x8004a) returned 0 [0092.550] GetActiveWindow () returned 0x7002e [0092.550] GetFocus () returned 0x7002e [0092.550] MessageBoxW (hWnd=0x7002e, lpText="4tIp0dxJzuu98Uqf/UTLgQ==", lpCaption="", uType=0x0) returned 1 [0092.551] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0092.551] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0092.552] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0092.552] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0092.552] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0092.553] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0092.559] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x66020c) returned 0x1 [0092.560] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0092.560] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0092.846] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0092.861] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0092.861] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0092.861] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x66020c) returned 0x1 [0092.862] SetFocus (hWnd=0x7002e) returned 0x66020c [0092.865] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0092.866] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0092.866] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0092.867] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0092.867] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x66020c, lParam=0x0) returned 0x0 [0092.872] IsWindow (hWnd=0x7002e) returned 1 [0092.872] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0092.872] IsWindow (hWnd=0x7002e) returned 1 [0092.872] SetFocus (hWnd=0x7002e) returned 0x7002e [0092.872] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0092.872] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0092.872] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0092.872] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml", lpFilePart=0x0) returned 0x74 [0092.872] GetLastError () returned 0x0 [0092.872] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml", dwFileAttributes=0x80) returned 1 [0092.873] GetLastError () returned 0x0 [0092.873] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml", lpFilePart=0x0) returned 0x74 [0092.873] GetLastError () returned 0x0 [0092.873] SetErrorMode (uMode=0x1) returned 0x0 [0092.873] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0092.873] GetLastError () returned 0x0 [0092.873] GetFileType (hFile=0x3f4) returned 0x1 [0092.873] SetErrorMode (uMode=0x0) returned 0x1 [0092.873] GetFileType (hFile=0x3f4) returned 0x1 [0092.873] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x8fe9a4 | out: lpFileSizeHigh=0x8fe9a4*=0x0) returned 0x7fa [0092.873] GetLastError () returned 0x0 [0092.873] ReadFile (in: hFile=0x3f4, lpBuffer=0x2aaff58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe94c, lpOverlapped=0x0 | out: lpBuffer=0x2aaff58*, lpNumberOfBytesRead=0x8fe94c*=0x7fa, lpOverlapped=0x0) returned 1 [0092.875] GetLastError () returned 0x0 [0092.875] CloseHandle (hObject=0x3f4) returned 1 [0092.875] GetLastError () returned 0x0 [0092.875] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0092.875] GetLastError () returned 0x0 [0092.875] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8f4 | out: phKey=0x8fe8f4*=0x9f6660) returned 1 [0092.875] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0092.875] GetLastError () returned 0x0 [0092.875] CryptSetKeyParam (hKey=0x9f6660, dwParam=0x4, pbData=0x2ab0fcc*=0x1, dwFlags=0x0) returned 1 [0092.875] GetLastError () returned 0x0 [0092.875] CryptSetKeyParam (hKey=0x9f6660, dwParam=0x1, pbData=0x2ab0f98, dwFlags=0x0) returned 1 [0092.875] GetLastError () returned 0x0 [0092.875] CryptEncrypt (in: hKey=0x9f6660, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2ab0fdc*, pdwDataLen=0x8fe9ac*=0x800, dwBufLen=0x800 | out: pbData=0x2ab0fdc*, pdwDataLen=0x8fe9ac*=0x800) returned 1 [0092.875] GetLastError () returned 0x0 [0092.876] CryptEncrypt (in: hKey=0x9f6660, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ab17fc*, pdwDataLen=0x8fe9b4*=0x0, dwBufLen=0x10 | out: pbData=0x2ab17fc*, pdwDataLen=0x8fe9b4*=0x10) returned 1 [0092.876] GetLastError () returned 0x0 [0092.876] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml", lpFilePart=0x0) returned 0x74 [0092.876] GetLastError () returned 0x0 [0092.876] SetErrorMode (uMode=0x1) returned 0x0 [0092.876] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0092.877] GetLastError () returned 0xb7 [0092.877] GetFileType (hFile=0x3f4) returned 0x1 [0092.877] SetErrorMode (uMode=0x0) returned 0x1 [0092.877] GetFileType (hFile=0x3f4) returned 0x1 [0092.877] WriteFile (in: hFile=0x3f4, lpBuffer=0x2ab1cc0*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x8fe920, lpOverlapped=0x0 | out: lpBuffer=0x2ab1cc0*, lpNumberOfBytesWritten=0x8fe920*=0x800, lpOverlapped=0x0) returned 1 [0092.878] GetLastError () returned 0xb7 [0092.878] CloseHandle (hObject=0x3f4) returned 1 [0092.879] GetLastError () returned 0xb7 [0092.879] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml.4tIp0dxJzuu98Uqf#UTLgQ==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml.4tIp0dxJzuu98Uqf#UTLgQ==.bwall", lpFilePart=0x0) returned 0x93 [0092.879] GetLastError () returned 0xb7 [0092.879] SetErrorMode (uMode=0x1) returned 0x0 [0092.879] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml.4tIp0dxJzuu98Uqf#UTLgQ==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml.4tip0dxjzuu98uqf#utlgq==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0092.879] GetLastError () returned 0x0 [0092.879] GetFileType (hFile=0x3f4) returned 0x1 [0092.879] SetErrorMode (uMode=0x0) returned 0x1 [0092.879] GetFileType (hFile=0x3f4) returned 0x1 [0092.879] WriteFile (in: hFile=0x3f4, lpBuffer=0x2ab2ffc*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x8fe920, lpOverlapped=0x0 | out: lpBuffer=0x2ab2ffc*, lpNumberOfBytesWritten=0x8fe920*=0x800, lpOverlapped=0x0) returned 1 [0092.880] GetLastError () returned 0x0 [0092.880] CloseHandle (hObject=0x3f4) returned 1 [0092.881] GetLastError () returned 0x0 [0092.881] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml", lpFilePart=0x0) returned 0x74 [0092.881] GetLastError () returned 0x0 [0092.881] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml")) returned 1 [0092.882] GetLastError () returned 0x0 [0092.882] GetProcessWindowStation () returned 0x13c [0092.882] GetActiveWindow () returned 0x7002e [0092.882] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0092.882] GetCurrentThreadId () returned 0x540 [0092.882] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4a1a, lParam=0x0) returned 1 [0092.883] IsWindowVisible (hWnd=0x7002e) returned 0 [0092.883] IsWindowVisible (hWnd=0x4020e) returned 0 [0092.883] IsWindowVisible (hWnd=0x60044) returned 0 [0092.883] IsWindowVisible (hWnd=0x2021a) returned 0 [0092.883] IsWindowVisible (hWnd=0x8004a) returned 0 [0092.883] GetActiveWindow () returned 0x7002e [0092.883] GetFocus () returned 0x7002e [0092.886] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0092.887] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0092.887] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0092.888] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0092.888] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0092.888] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0092.888] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0092.895] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x67020c) returned 0x1 [0092.896] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0092.896] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0092.995] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0093.002] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0093.002] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0093.002] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x67020c) returned 0x1 [0093.003] SetFocus (hWnd=0x7002e) returned 0x67020c [0093.005] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0093.006] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0093.006] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0093.007] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0093.007] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x67020c, lParam=0x0) returned 0x0 [0093.014] IsWindow (hWnd=0x7002e) returned 1 [0093.014] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0093.014] IsWindow (hWnd=0x7002e) returned 1 [0093.014] SetFocus (hWnd=0x7002e) returned 0x7002e [0093.014] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0093.014] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0093.014] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0093.014] GetProcessWindowStation () returned 0x13c [0093.015] GetActiveWindow () returned 0x7002e [0093.015] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0093.015] GetCurrentThreadId () returned 0x540 [0093.015] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c49ea, lParam=0x0) returned 1 [0093.015] IsWindowVisible (hWnd=0x7002e) returned 0 [0093.015] IsWindowVisible (hWnd=0x4020e) returned 0 [0093.015] IsWindowVisible (hWnd=0x60044) returned 0 [0093.015] IsWindowVisible (hWnd=0x2021a) returned 0 [0093.015] IsWindowVisible (hWnd=0x8004a) returned 0 [0093.016] GetActiveWindow () returned 0x7002e [0093.016] GetFocus () returned 0x7002e [0093.016] MessageBoxW (hWnd=0x7002e, lpText="8sMZRDjZp5VbxSNXuoTfLQ==", lpCaption="", uType=0x0) returned 1 [0093.017] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0093.017] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0093.018] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0093.018] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0093.018] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0093.018] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0093.028] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x68020c) returned 0x1 [0093.029] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0093.029] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0093.202] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0093.209] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0093.209] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0093.209] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x68020c) returned 0x1 [0093.210] SetFocus (hWnd=0x7002e) returned 0x68020c [0093.213] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0093.214] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0093.214] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0093.214] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0093.215] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x68020c, lParam=0x0) returned 0x0 [0093.219] IsWindow (hWnd=0x7002e) returned 1 [0093.219] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0093.219] IsWindow (hWnd=0x7002e) returned 1 [0093.219] SetFocus (hWnd=0x7002e) returned 0x7002e [0093.219] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0093.219] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0093.219] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0093.219] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x87 [0093.219] GetLastError () returned 0x0 [0093.219] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", dwFileAttributes=0x80) returned 1 [0093.220] GetLastError () returned 0x0 [0093.220] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x87 [0093.220] GetLastError () returned 0x0 [0093.220] SetErrorMode (uMode=0x1) returned 0x0 [0093.220] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0093.220] GetLastError () returned 0x0 [0093.220] GetFileType (hFile=0x3f4) returned 0x1 [0093.220] SetErrorMode (uMode=0x0) returned 0x1 [0093.220] GetFileType (hFile=0x3f4) returned 0x1 [0093.220] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x8fe9a4 | out: lpFileSizeHigh=0x8fe9a4*=0x0) returned 0x12e4a [0093.220] GetLastError () returned 0x0 [0093.220] ReadFile (in: hFile=0x3f4, lpBuffer=0x2ab8e5c, nNumberOfBytesToRead=0x12e4a, lpNumberOfBytesRead=0x8fe94c, lpOverlapped=0x0 | out: lpBuffer=0x2ab8e5c*, lpNumberOfBytesRead=0x8fe94c*=0x12e4a, lpOverlapped=0x0) returned 1 [0093.222] GetLastError () returned 0x0 [0093.222] CloseHandle (hObject=0x3f4) returned 1 [0093.223] GetLastError () returned 0x0 [0093.223] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0093.223] GetLastError () returned 0x0 [0093.223] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8f4 | out: phKey=0x8fe8f4*=0x9f6060) returned 1 [0093.223] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0093.223] GetLastError () returned 0x0 [0093.223] CryptSetKeyParam (hKey=0x9f6060, dwParam=0x4, pbData=0x2acbd1c*=0x1, dwFlags=0x0) returned 1 [0093.223] GetLastError () returned 0x0 [0093.223] CryptSetKeyParam (hKey=0x9f6060, dwParam=0x1, pbData=0x2acbce8, dwFlags=0x0) returned 1 [0093.223] GetLastError () returned 0x0 [0093.223] CryptEncrypt (in: hKey=0x9f6060, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2acbd2c*, pdwDataLen=0x8fe9ac*=0x12e50, dwBufLen=0x12e50 | out: pbData=0x2acbd2c*, pdwDataLen=0x8fe9ac*=0x12e50) returned 1 [0093.223] GetLastError () returned 0x0 [0093.223] CryptEncrypt (in: hKey=0x9f6060, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2adeb9c*, pdwDataLen=0x8fe9b4*=0x0, dwBufLen=0x10 | out: pbData=0x2adeb9c*, pdwDataLen=0x8fe9b4*=0x10) returned 1 [0093.223] GetLastError () returned 0x0 [0093.224] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x87 [0093.224] GetLastError () returned 0x0 [0093.224] SetErrorMode (uMode=0x1) returned 0x0 [0093.224] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0093.225] GetLastError () returned 0xb7 [0093.225] GetFileType (hFile=0x3f4) returned 0x1 [0093.225] SetErrorMode (uMode=0x0) returned 0x1 [0093.225] GetFileType (hFile=0x3f4) returned 0x1 [0093.225] WriteFile (in: hFile=0x3f4, lpBuffer=0x2acbd2c*, nNumberOfBytesToWrite=0x12e50, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2acbd2c*, lpNumberOfBytesWritten=0x8fe958*=0x12e50, lpOverlapped=0x0) returned 1 [0093.229] GetLastError () returned 0xb7 [0093.229] CloseHandle (hObject=0x3f4) returned 1 [0093.232] GetLastError () returned 0xb7 [0093.232] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml.8sMZRDjZp5VbxSNXuoTfLQ==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml.8sMZRDjZp5VbxSNXuoTfLQ==.bwall", lpFilePart=0x0) returned 0xa6 [0093.232] GetLastError () returned 0xb7 [0093.232] SetErrorMode (uMode=0x1) returned 0x0 [0093.232] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml.8sMZRDjZp5VbxSNXuoTfLQ==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml.8smzrdjzp5vbxsnxuotflq==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0093.232] GetLastError () returned 0x0 [0093.232] GetFileType (hFile=0x3f4) returned 0x1 [0093.232] SetErrorMode (uMode=0x0) returned 0x1 [0093.232] GetFileType (hFile=0x3f4) returned 0x1 [0093.232] WriteFile (in: hFile=0x3f4, lpBuffer=0x2acbd2c*, nNumberOfBytesToWrite=0x12e50, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2acbd2c*, lpNumberOfBytesWritten=0x8fe958*=0x12e50, lpOverlapped=0x0) returned 1 [0093.234] GetLastError () returned 0x0 [0093.234] CloseHandle (hObject=0x3f4) returned 1 [0093.236] GetLastError () returned 0x0 [0093.236] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x87 [0093.236] GetLastError () returned 0x0 [0093.236] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml")) returned 1 [0093.237] GetLastError () returned 0x0 [0093.237] GetProcessWindowStation () returned 0x13c [0093.237] GetActiveWindow () returned 0x7002e [0093.237] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0093.237] GetCurrentThreadId () returned 0x540 [0093.238] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4b9a, lParam=0x0) returned 1 [0093.238] IsWindowVisible (hWnd=0x7002e) returned 0 [0093.238] IsWindowVisible (hWnd=0x4020e) returned 0 [0093.238] IsWindowVisible (hWnd=0x60044) returned 0 [0093.238] IsWindowVisible (hWnd=0x2021a) returned 0 [0093.238] IsWindowVisible (hWnd=0x8004a) returned 0 [0093.238] GetActiveWindow () returned 0x7002e [0093.238] GetFocus () returned 0x7002e [0093.238] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0093.239] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0093.240] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0093.240] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0093.241] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0093.241] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0093.241] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0093.248] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x69020c) returned 0x1 [0093.249] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0093.249] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0100.572] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0100.582] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0100.582] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0100.583] GetWindowPlacement (in: hWnd=0x7002e, lpwndpl=0x8fdd20 | out: lpwndpl=0x8fdd20) returned 1 [0100.583] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x47, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0100.587] GetClientRect (in: hWnd=0x7002e, lpRect=0x8fdcbc | out: lpRect=0x8fdcbc) returned 1 [0100.587] GetWindowRect (in: hWnd=0x7002e, lpRect=0x8fdcbc | out: lpRect=0x8fdcbc) returned 1 [0100.587] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x47, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0100.588] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x69020c) returned 0x1 [0100.589] SetFocus (hWnd=0x7002e) returned 0x69020c [0100.591] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0100.592] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0100.593] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0100.593] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0100.593] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x69020c, lParam=0x0) returned 0x0 [0100.599] IsWindow (hWnd=0x7002e) returned 1 [0100.599] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0100.599] IsWindow (hWnd=0x7002e) returned 1 [0100.599] SetFocus (hWnd=0x7002e) returned 0x7002e [0100.599] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0100.599] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0100.599] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0100.600] GetProcessWindowStation () returned 0x13c [0100.600] GetActiveWindow () returned 0x7002e [0100.600] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0100.600] GetCurrentThreadId () returned 0x540 [0100.601] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4f5a, lParam=0x0) returned 1 [0100.601] IsWindowVisible (hWnd=0x7002e) returned 0 [0100.601] IsWindowVisible (hWnd=0x4020e) returned 0 [0100.601] IsWindowVisible (hWnd=0x60044) returned 0 [0100.601] IsWindowVisible (hWnd=0x2021a) returned 0 [0100.601] IsWindowVisible (hWnd=0x8004a) returned 0 [0100.601] GetActiveWindow () returned 0x7002e [0100.601] GetFocus () returned 0x7002e [0100.601] MessageBoxW (hWnd=0x7002e, lpText="AYhnhMErssde51faj3hUJQ==", lpCaption="", uType=0x0) returned 1 [0100.602] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0100.603] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0100.604] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0100.604] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0100.604] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0100.605] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0100.611] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x6a020c) returned 0x1 [0100.612] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0100.612] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0100.794] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0100.801] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0100.801] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0100.801] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x6a020c) returned 0x1 [0100.803] SetFocus (hWnd=0x7002e) returned 0x6a020c [0100.804] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0100.806] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0100.806] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0100.806] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0100.806] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x6a020c, lParam=0x0) returned 0x0 [0100.810] IsWindow (hWnd=0x7002e) returned 1 [0100.810] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0100.810] IsWindow (hWnd=0x7002e) returned 1 [0100.811] SetFocus (hWnd=0x7002e) returned 0x7002e [0100.811] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0100.811] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0100.811] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0100.811] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x78 [0100.811] GetLastError () returned 0x0 [0100.811] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml", dwFileAttributes=0x80) returned 1 [0100.812] GetLastError () returned 0x0 [0100.812] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x78 [0100.812] GetLastError () returned 0x0 [0100.812] SetErrorMode (uMode=0x1) returned 0x0 [0100.812] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0100.812] GetLastError () returned 0x0 [0100.812] GetFileType (hFile=0x3f4) returned 0x1 [0100.812] SetErrorMode (uMode=0x0) returned 0x1 [0100.812] GetFileType (hFile=0x3f4) returned 0x1 [0100.813] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x8fe9a4 | out: lpFileSizeHigh=0x8fe9a4*=0x0) returned 0x3734 [0100.813] GetLastError () returned 0x0 [0100.813] ReadFile (in: hFile=0x3f4, lpBuffer=0x2ae4228, nNumberOfBytesToRead=0x3734, lpNumberOfBytesRead=0x8fe94c, lpOverlapped=0x0 | out: lpBuffer=0x2ae4228*, lpNumberOfBytesRead=0x8fe94c*=0x3734, lpOverlapped=0x0) returned 1 [0100.814] GetLastError () returned 0x0 [0100.815] CloseHandle (hObject=0x3f4) returned 1 [0100.815] GetLastError () returned 0x0 [0100.815] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0100.815] GetLastError () returned 0x0 [0100.815] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8f4 | out: phKey=0x8fe8f4*=0x9f6720) returned 1 [0100.815] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0100.815] GetLastError () returned 0x0 [0100.815] CryptSetKeyParam (hKey=0x9f6720, dwParam=0x4, pbData=0x2ae79d0*=0x1, dwFlags=0x0) returned 1 [0100.815] GetLastError () returned 0x0 [0100.815] CryptSetKeyParam (hKey=0x9f6720, dwParam=0x1, pbData=0x2ae799c, dwFlags=0x0) returned 1 [0100.815] GetLastError () returned 0x0 [0100.815] CryptEncrypt (in: hKey=0x9f6720, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2ae79e0*, pdwDataLen=0x8fe9ac*=0x3740, dwBufLen=0x3740 | out: pbData=0x2ae79e0*, pdwDataLen=0x8fe9ac*=0x3740) returned 1 [0100.815] GetLastError () returned 0x0 [0100.816] CryptEncrypt (in: hKey=0x9f6720, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2aeb140*, pdwDataLen=0x8fe9b4*=0x0, dwBufLen=0x10 | out: pbData=0x2aeb140*, pdwDataLen=0x8fe9b4*=0x10) returned 1 [0100.816] GetLastError () returned 0x0 [0100.816] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x78 [0100.816] GetLastError () returned 0x0 [0100.816] SetErrorMode (uMode=0x1) returned 0x0 [0100.816] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0100.817] GetLastError () returned 0xb7 [0100.817] GetFileType (hFile=0x3f4) returned 0x1 [0100.817] SetErrorMode (uMode=0x0) returned 0x1 [0100.817] GetFileType (hFile=0x3f4) returned 0x1 [0100.817] WriteFile (in: hFile=0x3f4, lpBuffer=0x2ae79e0*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2ae79e0*, lpNumberOfBytesWritten=0x8fe958*=0x3740, lpOverlapped=0x0) returned 1 [0100.821] GetLastError () returned 0xb7 [0100.821] CloseHandle (hObject=0x3f4) returned 1 [0100.823] GetLastError () returned 0xb7 [0100.823] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml.AYhnhMErssde51faj3hUJQ==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml.AYhnhMErssde51faj3hUJQ==.bwall", lpFilePart=0x0) returned 0x97 [0100.823] GetLastError () returned 0xb7 [0100.823] SetErrorMode (uMode=0x1) returned 0x0 [0100.823] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml.AYhnhMErssde51faj3hUJQ==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml.ayhnhmerssde51faj3hujq==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0100.823] GetLastError () returned 0x0 [0100.823] GetFileType (hFile=0x3f4) returned 0x1 [0100.823] SetErrorMode (uMode=0x0) returned 0x1 [0100.823] GetFileType (hFile=0x3f4) returned 0x1 [0100.823] WriteFile (in: hFile=0x3f4, lpBuffer=0x2ae79e0*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2ae79e0*, lpNumberOfBytesWritten=0x8fe958*=0x3740, lpOverlapped=0x0) returned 1 [0100.824] GetLastError () returned 0x0 [0100.825] CloseHandle (hObject=0x3f4) returned 1 [0100.825] GetLastError () returned 0x0 [0100.825] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x78 [0100.825] GetLastError () returned 0x0 [0100.825] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml")) returned 1 [0100.826] GetLastError () returned 0x0 [0100.826] GetProcessWindowStation () returned 0x13c [0100.827] GetActiveWindow () returned 0x7002e [0100.827] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0100.827] GetCurrentThreadId () returned 0x540 [0100.827] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4efa, lParam=0x0) returned 1 [0100.827] IsWindowVisible (hWnd=0x7002e) returned 0 [0100.827] IsWindowVisible (hWnd=0x4020e) returned 0 [0100.827] IsWindowVisible (hWnd=0x60044) returned 0 [0100.827] IsWindowVisible (hWnd=0x2021a) returned 0 [0100.827] IsWindowVisible (hWnd=0x8004a) returned 0 [0100.828] GetActiveWindow () returned 0x7002e [0100.828] GetFocus () returned 0x7002e [0100.828] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0100.829] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0100.829] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0100.830] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0100.830] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0100.830] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0100.833] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0100.843] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x6b020c) returned 0x1 [0100.844] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0100.844] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0101.012] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0101.019] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0101.019] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0101.019] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x6b020c) returned 0x1 [0101.020] SetFocus (hWnd=0x7002e) returned 0x6b020c [0101.025] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0101.026] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0101.026] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0101.026] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0101.026] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x6b020c, lParam=0x0) returned 0x0 [0101.031] IsWindow (hWnd=0x7002e) returned 1 [0101.031] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0101.031] IsWindow (hWnd=0x7002e) returned 1 [0101.031] SetFocus (hWnd=0x7002e) returned 0x7002e [0101.031] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0101.031] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0101.031] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0101.031] GetProcessWindowStation () returned 0x13c [0101.031] GetActiveWindow () returned 0x7002e [0101.031] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0101.031] GetCurrentThreadId () returned 0x540 [0101.032] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4e3a, lParam=0x0) returned 1 [0101.032] IsWindowVisible (hWnd=0x7002e) returned 0 [0101.032] IsWindowVisible (hWnd=0x4020e) returned 0 [0101.032] IsWindowVisible (hWnd=0x60044) returned 0 [0101.032] IsWindowVisible (hWnd=0x2021a) returned 0 [0101.032] IsWindowVisible (hWnd=0x8004a) returned 0 [0101.032] GetActiveWindow () returned 0x7002e [0101.032] GetFocus () returned 0x7002e [0101.032] MessageBoxW (hWnd=0x7002e, lpText="MjyPYYKz1x225xGjFDRx+A==", lpCaption="", uType=0x0) returned 1 [0101.033] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0101.034] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0101.034] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0101.035] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0101.035] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0101.035] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0101.042] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x6c020c) returned 0x1 [0101.042] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0101.043] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0101.214] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0101.222] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0101.222] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0101.222] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x6c020c) returned 0x1 [0101.224] SetFocus (hWnd=0x7002e) returned 0x6c020c [0101.229] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0101.230] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0101.230] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0101.231] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0101.231] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x6c020c, lParam=0x0) returned 0x0 [0101.235] IsWindow (hWnd=0x7002e) returned 1 [0101.235] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0101.235] IsWindow (hWnd=0x7002e) returned 1 [0101.235] SetFocus (hWnd=0x7002e) returned 0x7002e [0101.235] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0101.235] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0101.235] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0101.236] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x81 [0101.236] GetLastError () returned 0x0 [0101.236] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml", dwFileAttributes=0x80) returned 1 [0101.237] GetLastError () returned 0x0 [0101.237] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x81 [0101.237] GetLastError () returned 0x0 [0101.237] SetErrorMode (uMode=0x1) returned 0x0 [0101.237] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0101.237] GetLastError () returned 0x0 [0101.237] GetFileType (hFile=0x3f4) returned 0x1 [0101.237] SetErrorMode (uMode=0x0) returned 0x1 [0101.237] GetFileType (hFile=0x3f4) returned 0x1 [0101.237] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x8fe9a4 | out: lpFileSizeHigh=0x8fe9a4*=0x0) returned 0xb27ee [0101.237] GetLastError () returned 0x0 [0101.239] ReadFile (in: hFile=0x3f4, lpBuffer=0x3a4aba0, nNumberOfBytesToRead=0xb27ee, lpNumberOfBytesRead=0x8fe94c, lpOverlapped=0x0 | out: lpBuffer=0x3a4aba0*, lpNumberOfBytesRead=0x8fe94c*=0xb27ee, lpOverlapped=0x0) returned 1 [0101.271] GetLastError () returned 0x0 [0101.272] CloseHandle (hObject=0x3f4) returned 1 [0101.272] GetLastError () returned 0x0 [0101.272] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0101.272] GetLastError () returned 0x0 [0101.272] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8f4 | out: phKey=0x8fe8f4*=0x9f6760) returned 1 [0101.272] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0101.272] GetLastError () returned 0x0 [0101.272] CryptSetKeyParam (hKey=0x9f6760, dwParam=0x4, pbData=0x2af07b8*=0x1, dwFlags=0x0) returned 1 [0101.272] GetLastError () returned 0x0 [0101.272] CryptSetKeyParam (hKey=0x9f6760, dwParam=0x1, pbData=0x2af0784, dwFlags=0x0) returned 1 [0101.272] GetLastError () returned 0x0 [0101.285] CryptEncrypt (in: hKey=0x9f6760, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3afd3b0*, pdwDataLen=0x8fe9ac*=0xb27f0, dwBufLen=0xb27f0 | out: pbData=0x3afd3b0*, pdwDataLen=0x8fe9ac*=0xb27f0) returned 1 [0101.286] GetLastError () returned 0x0 [0101.286] CryptEncrypt (in: hKey=0x9f6760, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2af07dc*, pdwDataLen=0x8fe9b4*=0x0, dwBufLen=0x10 | out: pbData=0x2af07dc*, pdwDataLen=0x8fe9b4*=0x10) returned 1 [0101.286] GetLastError () returned 0x0 [0101.286] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x81 [0101.287] GetLastError () returned 0x0 [0101.289] SetErrorMode (uMode=0x1) returned 0x0 [0101.289] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0101.295] GetLastError () returned 0xb7 [0101.295] GetFileType (hFile=0x3f4) returned 0x1 [0101.295] SetErrorMode (uMode=0x0) returned 0x1 [0101.295] GetFileType (hFile=0x3f4) returned 0x1 [0101.295] WriteFile (in: hFile=0x3f4, lpBuffer=0x3afd3b0*, nNumberOfBytesToWrite=0xb27f0, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x3afd3b0*, lpNumberOfBytesWritten=0x8fe958*=0xb27f0, lpOverlapped=0x0) returned 1 [0101.306] GetLastError () returned 0xb7 [0101.307] CloseHandle (hObject=0x3f4) returned 1 [0101.324] GetLastError () returned 0xb7 [0101.324] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.MjyPYYKz1x225xGjFDRx+A==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.MjyPYYKz1x225xGjFDRx+A==.bwall", lpFilePart=0x0) returned 0xa0 [0101.324] GetLastError () returned 0xb7 [0101.324] SetErrorMode (uMode=0x1) returned 0x0 [0101.324] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.MjyPYYKz1x225xGjFDRx+A==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml.mjypyykz1x225xgjfdrx+a==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0101.324] GetLastError () returned 0x0 [0101.324] GetFileType (hFile=0x3f4) returned 0x1 [0101.325] SetErrorMode (uMode=0x0) returned 0x1 [0101.325] GetFileType (hFile=0x3f4) returned 0x1 [0101.325] WriteFile (in: hFile=0x3f4, lpBuffer=0x3afd3b0*, nNumberOfBytesToWrite=0xb27f0, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x3afd3b0*, lpNumberOfBytesWritten=0x8fe958*=0xb27f0, lpOverlapped=0x0) returned 1 [0101.336] GetLastError () returned 0x0 [0101.336] CloseHandle (hObject=0x3f4) returned 1 [0101.349] GetLastError () returned 0x0 [0101.349] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x81 [0101.349] GetLastError () returned 0x0 [0101.349] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml")) returned 1 [0101.357] GetLastError () returned 0x0 [0101.361] GetProcessWindowStation () returned 0x13c [0101.361] GetActiveWindow () returned 0x7002e [0101.361] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0101.361] GetCurrentThreadId () returned 0x540 [0101.362] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4ada, lParam=0x0) returned 1 [0101.362] IsWindowVisible (hWnd=0x7002e) returned 0 [0101.362] IsWindowVisible (hWnd=0x4020e) returned 0 [0101.362] IsWindowVisible (hWnd=0x60044) returned 0 [0101.362] IsWindowVisible (hWnd=0x2021a) returned 0 [0101.362] IsWindowVisible (hWnd=0x8004a) returned 0 [0101.362] GetActiveWindow () returned 0x7002e [0101.362] GetFocus () returned 0x7002e [0101.363] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0101.363] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0101.364] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0101.367] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0101.368] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0101.368] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0101.368] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0101.374] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x6d020c) returned 0x1 [0101.375] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0101.375] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0101.510] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0101.520] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0101.520] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0101.520] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x6d020c) returned 0x1 [0101.522] SetFocus (hWnd=0x7002e) returned 0x6d020c [0101.525] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0101.527] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0101.527] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0101.527] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0101.527] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x6d020c, lParam=0x0) returned 0x0 [0101.533] IsWindow (hWnd=0x7002e) returned 1 [0101.534] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0101.534] IsWindow (hWnd=0x7002e) returned 1 [0101.534] SetFocus (hWnd=0x7002e) returned 0x7002e [0101.534] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0101.534] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0101.534] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0101.534] GetProcessWindowStation () returned 0x13c [0101.534] GetActiveWindow () returned 0x7002e [0101.534] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0101.534] GetCurrentThreadId () returned 0x540 [0101.535] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4a4a, lParam=0x0) returned 1 [0101.535] IsWindowVisible (hWnd=0x7002e) returned 0 [0101.535] IsWindowVisible (hWnd=0x4020e) returned 0 [0101.535] IsWindowVisible (hWnd=0x60044) returned 0 [0101.535] IsWindowVisible (hWnd=0x2021a) returned 0 [0101.535] IsWindowVisible (hWnd=0x8004a) returned 0 [0101.535] GetActiveWindow () returned 0x7002e [0101.535] GetFocus () returned 0x7002e [0101.535] MessageBoxW (hWnd=0x7002e, lpText="L5qSovTDAGixIY6u0jJoxw==", lpCaption="", uType=0x0) returned 1 [0101.536] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0101.539] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0101.540] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0101.540] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0101.540] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0101.541] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0101.548] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x6e020c) returned 0x1 [0101.549] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0101.549] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0101.700] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0101.708] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0101.708] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0101.708] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x6e020c) returned 0x1 [0101.712] SetFocus (hWnd=0x7002e) returned 0x6e020c [0101.714] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0101.715] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0101.715] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0101.715] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0101.715] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x6e020c, lParam=0x0) returned 0x0 [0101.720] IsWindow (hWnd=0x7002e) returned 1 [0101.720] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0101.720] IsWindow (hWnd=0x7002e) returned 1 [0101.720] SetFocus (hWnd=0x7002e) returned 0x7002e [0101.720] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0101.720] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0101.720] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0101.720] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7f [0101.720] GetLastError () returned 0x0 [0101.720] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", dwFileAttributes=0x80) returned 1 [0101.722] GetLastError () returned 0x0 [0101.722] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7f [0101.722] GetLastError () returned 0x0 [0101.722] SetErrorMode (uMode=0x1) returned 0x0 [0101.722] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0101.722] GetLastError () returned 0x0 [0101.722] GetFileType (hFile=0x3f4) returned 0x1 [0101.722] SetErrorMode (uMode=0x0) returned 0x1 [0101.722] GetFileType (hFile=0x3f4) returned 0x1 [0101.723] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x8fe9a4 | out: lpFileSizeHigh=0x8fe9a4*=0x0) returned 0x2aafe [0101.723] GetLastError () returned 0x0 [0101.723] ReadFile (in: hFile=0x3f4, lpBuffer=0x3bafbc0, nNumberOfBytesToRead=0x2aafe, lpNumberOfBytesRead=0x8fe94c, lpOverlapped=0x0 | out: lpBuffer=0x3bafbc0*, lpNumberOfBytesRead=0x8fe94c*=0x2aafe, lpOverlapped=0x0) returned 1 [0101.785] GetLastError () returned 0x0 [0101.785] CloseHandle (hObject=0x3f4) returned 1 [0101.785] GetLastError () returned 0x0 [0101.785] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0101.785] GetLastError () returned 0x0 [0101.785] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8f4 | out: phKey=0x8fe8f4*=0x9f66a0) returned 1 [0101.785] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0101.785] GetLastError () returned 0x0 [0101.785] CryptSetKeyParam (hKey=0x9f66a0, dwParam=0x4, pbData=0x2af5eb0*=0x1, dwFlags=0x0) returned 1 [0101.785] GetLastError () returned 0x0 [0101.785] CryptSetKeyParam (hKey=0x9f66a0, dwParam=0x1, pbData=0x2af5e7c, dwFlags=0x0) returned 1 [0101.785] GetLastError () returned 0x0 [0101.791] CryptEncrypt (in: hKey=0x9f66a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3bda6e0*, pdwDataLen=0x8fe9ac*=0x2ab00, dwBufLen=0x2ab00 | out: pbData=0x3bda6e0*, pdwDataLen=0x8fe9ac*=0x2ab00) returned 1 [0101.791] GetLastError () returned 0x0 [0101.791] CryptEncrypt (in: hKey=0x9f66a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2af5ed4*, pdwDataLen=0x8fe9b4*=0x0, dwBufLen=0x10 | out: pbData=0x2af5ed4*, pdwDataLen=0x8fe9b4*=0x10) returned 1 [0101.791] GetLastError () returned 0x0 [0101.791] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7f [0101.791] GetLastError () returned 0x0 [0101.791] SetErrorMode (uMode=0x1) returned 0x0 [0101.791] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0101.793] GetLastError () returned 0xb7 [0101.793] GetFileType (hFile=0x3f4) returned 0x1 [0101.793] SetErrorMode (uMode=0x0) returned 0x1 [0101.794] GetFileType (hFile=0x3f4) returned 0x1 [0101.794] WriteFile (in: hFile=0x3f4, lpBuffer=0x3bda6e0*, nNumberOfBytesToWrite=0x2ab00, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x3bda6e0*, lpNumberOfBytesWritten=0x8fe958*=0x2ab00, lpOverlapped=0x0) returned 1 [0101.796] GetLastError () returned 0xb7 [0101.797] CloseHandle (hObject=0x3f4) returned 1 [0101.800] GetLastError () returned 0xb7 [0101.800] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml.L5qSovTDAGixIY6u0jJoxw==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml.L5qSovTDAGixIY6u0jJoxw==.bwall", lpFilePart=0x0) returned 0x9e [0101.800] GetLastError () returned 0xb7 [0101.801] SetErrorMode (uMode=0x1) returned 0x0 [0101.801] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml.L5qSovTDAGixIY6u0jJoxw==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml.l5qsovtdagixiy6u0jjoxw==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0101.801] GetLastError () returned 0x0 [0101.801] GetFileType (hFile=0x3f4) returned 0x1 [0101.801] SetErrorMode (uMode=0x0) returned 0x1 [0101.801] GetFileType (hFile=0x3f4) returned 0x1 [0101.801] WriteFile (in: hFile=0x3f4, lpBuffer=0x3bda6e0*, nNumberOfBytesToWrite=0x2ab00, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x3bda6e0*, lpNumberOfBytesWritten=0x8fe958*=0x2ab00, lpOverlapped=0x0) returned 1 [0101.805] GetLastError () returned 0x0 [0101.805] CloseHandle (hObject=0x3f4) returned 1 [0101.808] GetLastError () returned 0x0 [0101.808] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7f [0101.808] GetLastError () returned 0x0 [0101.808] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml")) returned 1 [0101.810] GetLastError () returned 0x0 [0101.810] GetProcessWindowStation () returned 0x13c [0101.810] GetActiveWindow () returned 0x7002e [0101.810] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0101.810] GetCurrentThreadId () returned 0x540 [0101.811] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4bca, lParam=0x0) returned 1 [0101.811] IsWindowVisible (hWnd=0x7002e) returned 0 [0101.811] IsWindowVisible (hWnd=0x4020e) returned 0 [0101.811] IsWindowVisible (hWnd=0x60044) returned 0 [0101.811] IsWindowVisible (hWnd=0x2021a) returned 0 [0101.811] IsWindowVisible (hWnd=0x8004a) returned 0 [0101.811] GetActiveWindow () returned 0x7002e [0101.811] GetFocus () returned 0x7002e [0101.811] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0101.812] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0101.813] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0101.813] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0101.814] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0101.814] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0101.821] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0101.827] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x6f020c) returned 0x1 [0101.829] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0101.829] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0102.112] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0102.120] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0102.120] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0102.120] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x6f020c) returned 0x1 [0102.121] SetFocus (hWnd=0x7002e) returned 0x6f020c [0102.123] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0102.125] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0102.125] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0102.125] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0102.125] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x6f020c, lParam=0x0) returned 0x0 [0102.129] IsWindow (hWnd=0x7002e) returned 1 [0102.129] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0102.129] IsWindow (hWnd=0x7002e) returned 1 [0102.129] SetFocus (hWnd=0x7002e) returned 0x7002e [0102.129] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0102.129] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0102.130] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0102.130] GetProcessWindowStation () returned 0x13c [0102.130] GetActiveWindow () returned 0x7002e [0102.130] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0102.130] GetCurrentThreadId () returned 0x540 [0102.133] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4aaa, lParam=0x0) returned 1 [0102.133] IsWindowVisible (hWnd=0x7002e) returned 0 [0102.133] IsWindowVisible (hWnd=0x4020e) returned 0 [0102.133] IsWindowVisible (hWnd=0x60044) returned 0 [0102.133] IsWindowVisible (hWnd=0x2021a) returned 0 [0102.133] IsWindowVisible (hWnd=0x8004a) returned 0 [0102.133] GetActiveWindow () returned 0x7002e [0102.133] GetFocus () returned 0x7002e [0102.133] MessageBoxW (hWnd=0x7002e, lpText="l6J/RQN28vkZcXcYZZcrrQ==", lpCaption="", uType=0x0) returned 1 [0102.134] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0102.135] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0102.135] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0102.136] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0102.136] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0102.136] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0102.143] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x70020c) returned 0x1 [0102.144] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0102.144] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0102.268] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0102.277] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0102.277] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0102.278] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x70020c) returned 0x1 [0102.279] SetFocus (hWnd=0x7002e) returned 0x70020c [0102.281] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0102.282] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0102.282] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0102.282] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0102.282] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x70020c, lParam=0x0) returned 0x0 [0102.286] IsWindow (hWnd=0x7002e) returned 1 [0102.287] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0102.289] IsWindow (hWnd=0x7002e) returned 1 [0102.289] SetFocus (hWnd=0x7002e) returned 0x7002e [0102.289] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0102.289] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0102.289] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0102.289] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x74 [0102.289] GetLastError () returned 0x0 [0102.289] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml", dwFileAttributes=0x80) returned 1 [0102.291] GetLastError () returned 0x0 [0102.291] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x74 [0102.291] GetLastError () returned 0x0 [0102.291] SetErrorMode (uMode=0x1) returned 0x0 [0102.291] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visiomui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0102.291] GetLastError () returned 0x0 [0102.291] GetFileType (hFile=0x3f4) returned 0x1 [0102.291] SetErrorMode (uMode=0x0) returned 0x1 [0102.291] GetFileType (hFile=0x3f4) returned 0x1 [0102.291] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x8fe9a4 | out: lpFileSizeHigh=0x8fe9a4*=0x0) returned 0xf0cb4 [0102.291] GetLastError () returned 0x0 [0102.294] ReadFile (in: hFile=0x3f4, lpBuffer=0x3c05200, nNumberOfBytesToRead=0xf0cb4, lpNumberOfBytesRead=0x8fe94c, lpOverlapped=0x0 | out: lpBuffer=0x3c05200*, lpNumberOfBytesRead=0x8fe94c*=0xf0cb4, lpOverlapped=0x0) returned 1 [0102.321] GetLastError () returned 0x0 [0102.321] CloseHandle (hObject=0x3f4) returned 1 [0102.321] GetLastError () returned 0x0 [0102.321] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0102.321] GetLastError () returned 0x0 [0102.321] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8f4 | out: phKey=0x8fe8f4*=0x9f66e0) returned 1 [0102.321] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0102.321] GetLastError () returned 0x0 [0102.321] CryptSetKeyParam (hKey=0x9f66e0, dwParam=0x4, pbData=0x2afb550*=0x1, dwFlags=0x0) returned 1 [0102.321] GetLastError () returned 0x0 [0102.321] CryptSetKeyParam (hKey=0x9f66e0, dwParam=0x1, pbData=0x2afb51c, dwFlags=0x0) returned 1 [0102.321] GetLastError () returned 0x0 [0102.340] CryptEncrypt (in: hKey=0x9f66e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3cf5ed0*, pdwDataLen=0x8fe9ac*=0xf0cc0, dwBufLen=0xf0cc0 | out: pbData=0x3cf5ed0*, pdwDataLen=0x8fe9ac*=0xf0cc0) returned 1 [0102.341] GetLastError () returned 0x0 [0102.341] CryptEncrypt (in: hKey=0x9f66e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2afb574*, pdwDataLen=0x8fe9b4*=0x0, dwBufLen=0x10 | out: pbData=0x2afb574*, pdwDataLen=0x8fe9b4*=0x10) returned 1 [0102.341] GetLastError () returned 0x0 [0102.341] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x74 [0102.341] GetLastError () returned 0x0 [0102.341] SetErrorMode (uMode=0x1) returned 0x0 [0102.342] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visiomui.msi.16.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0102.351] GetLastError () returned 0xb7 [0102.351] GetFileType (hFile=0x3f4) returned 0x1 [0102.351] SetErrorMode (uMode=0x0) returned 0x1 [0102.351] GetFileType (hFile=0x3f4) returned 0x1 [0102.351] WriteFile (in: hFile=0x3f4, lpBuffer=0x3cf5ed0*, nNumberOfBytesToWrite=0xf0cc0, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x3cf5ed0*, lpNumberOfBytesWritten=0x8fe958*=0xf0cc0, lpOverlapped=0x0) returned 1 [0102.369] GetLastError () returned 0xb7 [0102.369] CloseHandle (hObject=0x3f4) returned 1 [0102.389] GetLastError () returned 0xb7 [0102.389] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml.l6J#RQN28vkZcXcYZZcrrQ==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml.l6J#RQN28vkZcXcYZZcrrQ==.bwall", lpFilePart=0x0) returned 0x93 [0102.389] GetLastError () returned 0xb7 [0102.389] SetErrorMode (uMode=0x1) returned 0x0 [0102.389] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml.l6J#RQN28vkZcXcYZZcrrQ==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visiomui.msi.16.en-us.xml.l6j#rqn28vkzcxcyzzcrrq==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0102.389] GetLastError () returned 0x0 [0102.389] GetFileType (hFile=0x3f4) returned 0x1 [0102.389] SetErrorMode (uMode=0x0) returned 0x1 [0102.390] GetFileType (hFile=0x3f4) returned 0x1 [0102.390] WriteFile (in: hFile=0x3f4, lpBuffer=0x3cf5ed0*, nNumberOfBytesToWrite=0xf0cc0, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x3cf5ed0*, lpNumberOfBytesWritten=0x8fe958*=0xf0cc0, lpOverlapped=0x0) returned 1 [0102.408] GetLastError () returned 0x0 [0102.408] CloseHandle (hObject=0x3f4) returned 1 [0102.436] GetLastError () returned 0x0 [0102.436] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x74 [0102.436] GetLastError () returned 0x0 [0102.436] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visiomui.msi.16.en-us.xml")) returned 1 [0102.444] GetLastError () returned 0x0 [0102.448] GetProcessWindowStation () returned 0x13c [0102.448] GetActiveWindow () returned 0x7002e [0102.448] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0102.448] GetCurrentThreadId () returned 0x540 [0102.449] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4b0a, lParam=0x0) returned 1 [0102.449] IsWindowVisible (hWnd=0x7002e) returned 0 [0102.449] IsWindowVisible (hWnd=0x4020e) returned 0 [0102.449] IsWindowVisible (hWnd=0x60044) returned 0 [0102.449] IsWindowVisible (hWnd=0x2021a) returned 0 [0102.449] IsWindowVisible (hWnd=0x8004a) returned 0 [0102.449] GetActiveWindow () returned 0x7002e [0102.449] GetFocus () returned 0x7002e [0102.449] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0102.451] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0102.453] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0102.454] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0102.454] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0102.454] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0102.454] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0102.463] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x71020c) returned 0x1 [0102.464] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0102.464] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0102.587] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0102.594] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0102.594] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0102.594] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x71020c) returned 0x1 [0102.595] SetFocus (hWnd=0x7002e) returned 0x71020c [0102.597] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0102.598] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0102.599] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0102.599] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0102.599] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x71020c, lParam=0x0) returned 0x0 [0102.605] IsWindow (hWnd=0x7002e) returned 1 [0102.605] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0102.605] IsWindow (hWnd=0x7002e) returned 1 [0102.605] SetFocus (hWnd=0x7002e) returned 0x7002e [0102.605] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0102.605] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0102.606] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0102.606] GetProcessWindowStation () returned 0x13c [0102.606] GetActiveWindow () returned 0x7002e [0102.606] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0102.606] GetCurrentThreadId () returned 0x540 [0102.606] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4c5a, lParam=0x0) returned 1 [0102.606] IsWindowVisible (hWnd=0x7002e) returned 0 [0102.606] IsWindowVisible (hWnd=0x4020e) returned 0 [0102.607] IsWindowVisible (hWnd=0x60044) returned 0 [0102.607] IsWindowVisible (hWnd=0x2021a) returned 0 [0102.607] IsWindowVisible (hWnd=0x8004a) returned 0 [0102.607] GetActiveWindow () returned 0x7002e [0102.607] GetFocus () returned 0x7002e [0102.607] MessageBoxW (hWnd=0x7002e, lpText="AEBfCjhXq4rNsSd0BeyX2w==", lpCaption="", uType=0x0) returned 1 [0102.608] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0102.608] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0102.609] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0102.609] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0102.609] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0102.610] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0102.616] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x72020c) returned 0x1 [0102.617] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0102.617] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0102.823] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0102.831] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0102.831] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0102.831] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x72020c) returned 0x1 [0102.832] SetFocus (hWnd=0x7002e) returned 0x72020c [0102.837] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0102.838] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0102.838] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0102.838] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0102.838] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x72020c, lParam=0x0) returned 0x0 [0102.843] IsWindow (hWnd=0x7002e) returned 1 [0102.843] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0102.843] IsWindow (hWnd=0x7002e) returned 1 [0102.843] SetFocus (hWnd=0x7002e) returned 0x7002e [0102.843] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0102.843] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0102.843] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0102.843] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7d [0102.843] GetLastError () returned 0x0 [0102.843] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml", dwFileAttributes=0x80) returned 1 [0102.844] GetLastError () returned 0x0 [0102.844] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7d [0102.844] GetLastError () returned 0x0 [0102.844] SetErrorMode (uMode=0x1) returned 0x0 [0102.844] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0102.844] GetLastError () returned 0x0 [0102.844] GetFileType (hFile=0x3f4) returned 0x1 [0102.844] SetErrorMode (uMode=0x0) returned 0x1 [0102.844] GetFileType (hFile=0x3f4) returned 0x1 [0102.844] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x8fe9a4 | out: lpFileSizeHigh=0x8fe9a4*=0x0) returned 0x1536e [0102.845] GetLastError () returned 0x0 [0102.867] ReadFile (in: hFile=0x3f4, lpBuffer=0x3a18010, nNumberOfBytesToRead=0x1536e, lpNumberOfBytesRead=0x8fe94c, lpOverlapped=0x0 | out: lpBuffer=0x3a18010*, lpNumberOfBytesRead=0x8fe94c*=0x1536e, lpOverlapped=0x0) returned 1 [0102.869] GetLastError () returned 0x0 [0102.869] CloseHandle (hObject=0x3f4) returned 1 [0102.869] GetLastError () returned 0x0 [0102.869] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0102.869] GetLastError () returned 0x0 [0102.870] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8f4 | out: phKey=0x8fe8f4*=0x9f67a0) returned 1 [0102.870] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0102.870] GetLastError () returned 0x0 [0102.870] CryptSetKeyParam (hKey=0x9f67a0, dwParam=0x4, pbData=0x2a39304*=0x1, dwFlags=0x0) returned 1 [0102.870] GetLastError () returned 0x0 [0102.870] CryptSetKeyParam (hKey=0x9f67a0, dwParam=0x1, pbData=0x2a392d0, dwFlags=0x0) returned 1 [0102.870] GetLastError () returned 0x0 [0102.871] CryptEncrypt (in: hKey=0x9f67a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a2d3a0*, pdwDataLen=0x8fe9ac*=0x15370, dwBufLen=0x15370 | out: pbData=0x3a2d3a0*, pdwDataLen=0x8fe9ac*=0x15370) returned 1 [0102.871] GetLastError () returned 0x0 [0102.871] CryptEncrypt (in: hKey=0x9f67a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2a39328*, pdwDataLen=0x8fe9b4*=0x0, dwBufLen=0x10 | out: pbData=0x2a39328*, pdwDataLen=0x8fe9b4*=0x10) returned 1 [0102.871] GetLastError () returned 0x0 [0102.871] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7d [0102.871] GetLastError () returned 0x0 [0102.871] SetErrorMode (uMode=0x1) returned 0x0 [0102.871] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0102.873] GetLastError () returned 0xb7 [0102.873] GetFileType (hFile=0x3f4) returned 0x1 [0102.873] SetErrorMode (uMode=0x0) returned 0x1 [0102.873] GetFileType (hFile=0x3f4) returned 0x1 [0102.873] WriteFile (in: hFile=0x3f4, lpBuffer=0x3a2d3a0*, nNumberOfBytesToWrite=0x15370, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x3a2d3a0*, lpNumberOfBytesWritten=0x8fe958*=0x15370, lpOverlapped=0x0) returned 1 [0102.875] GetLastError () returned 0xb7 [0102.875] CloseHandle (hObject=0x3f4) returned 1 [0102.877] GetLastError () returned 0xb7 [0102.877] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.AEBfCjhXq4rNsSd0BeyX2w==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.AEBfCjhXq4rNsSd0BeyX2w==.bwall", lpFilePart=0x0) returned 0x9c [0102.877] GetLastError () returned 0xb7 [0102.877] SetErrorMode (uMode=0x1) returned 0x0 [0102.877] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.AEBfCjhXq4rNsSd0BeyX2w==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml.aebfcjhxq4rnssd0beyx2w==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0102.877] GetLastError () returned 0x0 [0102.878] GetFileType (hFile=0x3f4) returned 0x1 [0102.878] SetErrorMode (uMode=0x0) returned 0x1 [0102.878] GetFileType (hFile=0x3f4) returned 0x1 [0102.878] WriteFile (in: hFile=0x3f4, lpBuffer=0x3a2d3a0*, nNumberOfBytesToWrite=0x15370, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x3a2d3a0*, lpNumberOfBytesWritten=0x8fe958*=0x15370, lpOverlapped=0x0) returned 1 [0102.880] GetLastError () returned 0x0 [0102.880] CloseHandle (hObject=0x3f4) returned 1 [0102.881] GetLastError () returned 0x0 [0102.881] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml", nBufferLength=0x105, lpBuffer=0x8fe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml", lpFilePart=0x0) returned 0x7d [0102.882] GetLastError () returned 0x0 [0102.882] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml")) returned 1 [0102.883] GetLastError () returned 0x0 [0102.889] GetProcessWindowStation () returned 0x13c [0102.889] GetActiveWindow () returned 0x7002e [0102.889] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0102.889] GetCurrentThreadId () returned 0x540 [0102.889] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4bfa, lParam=0x0) returned 1 [0102.889] IsWindowVisible (hWnd=0x7002e) returned 0 [0102.889] IsWindowVisible (hWnd=0x4020e) returned 0 [0102.890] IsWindowVisible (hWnd=0x60044) returned 0 [0102.890] IsWindowVisible (hWnd=0x2021a) returned 0 [0102.890] IsWindowVisible (hWnd=0x8004a) returned 0 [0102.890] GetActiveWindow () returned 0x7002e [0102.890] GetFocus () returned 0x7002e [0102.890] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0102.891] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0102.891] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0102.892] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0102.892] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0102.892] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0102.893] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0102.901] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x73020c) returned 0x1 [0102.901] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0102.901] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0103.008] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0103.015] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0103.015] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0103.015] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x73020c) returned 0x1 [0103.017] SetFocus (hWnd=0x7002e) returned 0x73020c [0103.019] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0103.020] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0103.020] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0103.020] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0103.020] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x73020c, lParam=0x0) returned 0x0 [0103.027] IsWindow (hWnd=0x7002e) returned 1 [0103.027] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0103.027] IsWindow (hWnd=0x7002e) returned 1 [0103.027] SetFocus (hWnd=0x7002e) returned 0x7002e [0103.027] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0103.027] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0103.027] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0103.027] GetProcessWindowStation () returned 0x13c [0103.027] GetActiveWindow () returned 0x7002e [0103.027] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0103.027] GetCurrentThreadId () returned 0x540 [0103.028] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4b9a, lParam=0x0) returned 1 [0103.028] IsWindowVisible (hWnd=0x7002e) returned 0 [0103.028] IsWindowVisible (hWnd=0x4020e) returned 0 [0103.028] IsWindowVisible (hWnd=0x60044) returned 0 [0103.028] IsWindowVisible (hWnd=0x2021a) returned 0 [0103.028] IsWindowVisible (hWnd=0x8004a) returned 0 [0103.028] GetActiveWindow () returned 0x7002e [0103.028] GetFocus () returned 0x7002e [0103.028] MessageBoxW (hWnd=0x7002e, lpText="yKFbC/WYb2JTYDE/IX4GFA==", lpCaption="", uType=0x0) returned 1 [0103.029] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0103.030] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0103.030] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0103.031] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0103.031] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0103.031] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0103.037] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x74020c) returned 0x1 [0103.038] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0103.038] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0103.198] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0103.206] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0103.206] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0103.206] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x74020c) returned 0x1 [0103.208] SetFocus (hWnd=0x7002e) returned 0x74020c [0103.212] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0103.214] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0103.215] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0103.215] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0103.215] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x74020c, lParam=0x0) returned 0x0 [0103.220] IsWindow (hWnd=0x7002e) returned 1 [0103.220] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0103.220] IsWindow (hWnd=0x7002e) returned 1 [0103.220] SetFocus (hWnd=0x7002e) returned 0x7002e [0103.220] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0103.220] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0103.220] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0103.220] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x73 [0103.220] GetLastError () returned 0x0 [0103.221] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml", dwFileAttributes=0x80) returned 1 [0103.223] GetLastError () returned 0x0 [0103.223] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x73 [0103.223] GetLastError () returned 0x0 [0103.223] SetErrorMode (uMode=0x1) returned 0x0 [0103.224] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0103.224] GetLastError () returned 0x0 [0103.224] GetFileType (hFile=0x3f4) returned 0x1 [0103.224] SetErrorMode (uMode=0x0) returned 0x1 [0103.224] GetFileType (hFile=0x3f4) returned 0x1 [0103.224] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x8fe9a4 | out: lpFileSizeHigh=0x8fe9a4*=0x0) returned 0x130fe [0103.224] GetLastError () returned 0x0 [0103.224] ReadFile (in: hFile=0x3f4, lpBuffer=0x2a3ea10, nNumberOfBytesToRead=0x130fe, lpNumberOfBytesRead=0x8fe94c, lpOverlapped=0x0 | out: lpBuffer=0x2a3ea10*, lpNumberOfBytesRead=0x8fe94c*=0x130fe, lpOverlapped=0x0) returned 1 [0103.226] GetLastError () returned 0x0 [0103.226] CloseHandle (hObject=0x3f4) returned 1 [0103.227] GetLastError () returned 0x0 [0103.227] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0103.227] GetLastError () returned 0x0 [0103.227] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8f4 | out: phKey=0x8fe8f4*=0x9f65e0) returned 1 [0103.227] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0103.227] GetLastError () returned 0x0 [0103.227] CryptSetKeyParam (hKey=0x9f65e0, dwParam=0x4, pbData=0x2a51b84*=0x1, dwFlags=0x0) returned 1 [0103.227] GetLastError () returned 0x0 [0103.227] CryptSetKeyParam (hKey=0x9f65e0, dwParam=0x1, pbData=0x2a51b50, dwFlags=0x0) returned 1 [0103.228] GetLastError () returned 0x0 [0103.228] CryptEncrypt (in: hKey=0x9f65e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2a51b94*, pdwDataLen=0x8fe9ac*=0x13100, dwBufLen=0x13100 | out: pbData=0x2a51b94*, pdwDataLen=0x8fe9ac*=0x13100) returned 1 [0103.228] GetLastError () returned 0x0 [0103.228] CryptEncrypt (in: hKey=0x9f65e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2a64cb4*, pdwDataLen=0x8fe9b4*=0x0, dwBufLen=0x10 | out: pbData=0x2a64cb4*, pdwDataLen=0x8fe9b4*=0x10) returned 1 [0103.228] GetLastError () returned 0x0 [0103.228] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x73 [0103.228] GetLastError () returned 0x0 [0103.229] SetErrorMode (uMode=0x1) returned 0x0 [0103.229] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0103.230] GetLastError () returned 0xb7 [0103.230] GetFileType (hFile=0x3f4) returned 0x1 [0103.230] SetErrorMode (uMode=0x0) returned 0x1 [0103.230] GetFileType (hFile=0x3f4) returned 0x1 [0103.230] WriteFile (in: hFile=0x3f4, lpBuffer=0x2a51b94*, nNumberOfBytesToWrite=0x13100, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2a51b94*, lpNumberOfBytesWritten=0x8fe958*=0x13100, lpOverlapped=0x0) returned 1 [0103.232] GetLastError () returned 0xb7 [0103.232] CloseHandle (hObject=0x3f4) returned 1 [0103.235] GetLastError () returned 0xb7 [0103.235] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml.yKFbC#WYb2JTYDE#IX4GFA==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml.yKFbC#WYb2JTYDE#IX4GFA==.bwall", lpFilePart=0x0) returned 0x92 [0103.235] GetLastError () returned 0xb7 [0103.235] SetErrorMode (uMode=0x1) returned 0x0 [0103.235] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml.yKFbC#WYb2JTYDE#IX4GFA==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml.ykfbc#wyb2jtyde#ix4gfa==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0103.236] GetLastError () returned 0x0 [0103.236] GetFileType (hFile=0x3f4) returned 0x1 [0103.236] SetErrorMode (uMode=0x0) returned 0x1 [0103.236] GetFileType (hFile=0x3f4) returned 0x1 [0103.236] WriteFile (in: hFile=0x3f4, lpBuffer=0x2a51b94*, nNumberOfBytesToWrite=0x13100, lpNumberOfBytesWritten=0x8fe958, lpOverlapped=0x0 | out: lpBuffer=0x2a51b94*, lpNumberOfBytesWritten=0x8fe958*=0x13100, lpOverlapped=0x0) returned 1 [0103.238] GetLastError () returned 0x0 [0103.238] CloseHandle (hObject=0x3f4) returned 1 [0103.240] GetLastError () returned 0x0 [0103.240] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml", nBufferLength=0x105, lpBuffer=0x8fe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml", lpFilePart=0x0) returned 0x73 [0103.244] GetLastError () returned 0x0 [0103.244] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml")) returned 1 [0103.245] GetLastError () returned 0x0 [0103.246] GetProcessWindowStation () returned 0x13c [0103.246] GetActiveWindow () returned 0x7002e [0103.246] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0103.246] GetCurrentThreadId () returned 0x540 [0103.247] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4e9a, lParam=0x0) returned 1 [0103.248] IsWindowVisible (hWnd=0x7002e) returned 0 [0103.248] IsWindowVisible (hWnd=0x4020e) returned 0 [0103.248] IsWindowVisible (hWnd=0x60044) returned 0 [0103.248] IsWindowVisible (hWnd=0x2021a) returned 0 [0103.248] IsWindowVisible (hWnd=0x8004a) returned 0 [0103.248] GetActiveWindow () returned 0x7002e [0103.248] GetFocus () returned 0x7002e [0103.248] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0103.249] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0103.251] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0103.252] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0103.252] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0103.252] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0103.252] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0103.260] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x75020c) returned 0x1 [0103.261] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0103.261] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0103.409] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0103.425] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0103.425] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0103.425] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x75020c) returned 0x1 [0103.427] SetFocus (hWnd=0x7002e) returned 0x75020c [0103.429] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0103.431] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0103.431] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0103.431] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0103.431] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x75020c, lParam=0x0) returned 0x0 [0103.436] IsWindow (hWnd=0x7002e) returned 1 [0103.436] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0103.436] IsWindow (hWnd=0x7002e) returned 1 [0103.436] SetFocus (hWnd=0x7002e) returned 0x7002e [0103.436] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0103.436] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0103.436] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0103.436] GetProcessWindowStation () returned 0x13c [0103.437] GetActiveWindow () returned 0x7002e [0103.437] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0103.437] GetCurrentThreadId () returned 0x540 [0103.437] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4cba, lParam=0x0) returned 1 [0103.437] IsWindowVisible (hWnd=0x7002e) returned 0 [0103.437] IsWindowVisible (hWnd=0x4020e) returned 0 [0103.437] IsWindowVisible (hWnd=0x60044) returned 0 [0103.437] IsWindowVisible (hWnd=0x2021a) returned 0 [0103.437] IsWindowVisible (hWnd=0x8004a) returned 0 [0103.438] GetActiveWindow () returned 0x7002e [0103.438] GetFocus () returned 0x7002e [0103.438] MessageBoxW (hWnd=0x7002e, lpText="H5QNPV28UkJG4U4fruBt0A==", lpCaption="", uType=0x0) returned 1 [0103.439] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0103.439] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0103.440] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0103.440] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0103.440] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0103.440] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0103.450] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x76020c) returned 0x1 [0103.450] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0103.451] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0103.602] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0103.609] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0103.610] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0103.610] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x76020c) returned 0x1 [0103.611] SetFocus (hWnd=0x7002e) returned 0x76020c [0103.613] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0103.614] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0103.614] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0103.614] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0103.614] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x76020c, lParam=0x0) returned 0x0 [0103.619] IsWindow (hWnd=0x7002e) returned 1 [0103.619] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0103.619] IsWindow (hWnd=0x7002e) returned 1 [0103.619] SetFocus (hWnd=0x7002e) returned 0x7002e [0103.619] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0103.619] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0103.619] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0103.619] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", lpFilePart=0x0) returned 0x84 [0103.619] GetLastError () returned 0x0 [0103.619] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", dwFileAttributes=0x80) returned 1 [0103.620] GetLastError () returned 0x0 [0103.621] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", lpFilePart=0x0) returned 0x84 [0103.621] GetLastError () returned 0x0 [0103.621] SetErrorMode (uMode=0x1) returned 0x0 [0103.621] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0103.621] GetLastError () returned 0x0 [0103.621] GetFileType (hFile=0x3f4) returned 0x1 [0103.621] SetErrorMode (uMode=0x0) returned 0x1 [0103.621] GetFileType (hFile=0x3f4) returned 0x1 [0103.621] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x8fe9a4 | out: lpFileSizeHigh=0x8fe9a4*=0x0) returned 0xce8 [0103.621] GetLastError () returned 0x0 [0103.621] ReadFile (in: hFile=0x3f4, lpBuffer=0x2a6f3a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe94c, lpOverlapped=0x0 | out: lpBuffer=0x2a6f3a0*, lpNumberOfBytesRead=0x8fe94c*=0xce8, lpOverlapped=0x0) returned 1 [0103.622] GetLastError () returned 0x0 [0103.623] CloseHandle (hObject=0x3f4) returned 1 [0103.623] GetLastError () returned 0x0 [0103.623] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0103.623] GetLastError () returned 0x0 [0103.623] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8f4 | out: phKey=0x8fe8f4*=0x9f67e0) returned 1 [0103.623] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0103.623] GetLastError () returned 0x0 [0103.623] CryptSetKeyParam (hKey=0x9f67e0, dwParam=0x4, pbData=0x2a70414*=0x1, dwFlags=0x0) returned 1 [0103.623] GetLastError () returned 0x0 [0103.623] CryptSetKeyParam (hKey=0x9f67e0, dwParam=0x1, pbData=0x2a703e0, dwFlags=0x0) returned 1 [0103.623] GetLastError () returned 0x0 [0103.623] CryptEncrypt (in: hKey=0x9f67e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2a70424*, pdwDataLen=0x8fe9ac*=0xcf0, dwBufLen=0xcf0 | out: pbData=0x2a70424*, pdwDataLen=0x8fe9ac*=0xcf0) returned 1 [0103.623] GetLastError () returned 0x0 [0103.623] CryptEncrypt (in: hKey=0x9f67e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2a71134*, pdwDataLen=0x8fe9b4*=0x0, dwBufLen=0x10 | out: pbData=0x2a71134*, pdwDataLen=0x8fe9b4*=0x10) returned 1 [0103.623] GetLastError () returned 0x0 [0103.623] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", lpFilePart=0x0) returned 0x84 [0103.623] GetLastError () returned 0x0 [0103.624] SetErrorMode (uMode=0x1) returned 0x0 [0103.624] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0103.624] GetLastError () returned 0xb7 [0103.625] GetFileType (hFile=0x3f4) returned 0x1 [0103.625] SetErrorMode (uMode=0x0) returned 0x1 [0103.625] GetFileType (hFile=0x3f4) returned 0x1 [0103.625] WriteFile (in: hFile=0x3f4, lpBuffer=0x2a71614*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x8fe920, lpOverlapped=0x0 | out: lpBuffer=0x2a71614*, lpNumberOfBytesWritten=0x8fe920*=0xcf0, lpOverlapped=0x0) returned 1 [0103.626] GetLastError () returned 0xb7 [0103.626] CloseHandle (hObject=0x3f4) returned 1 [0103.626] GetLastError () returned 0xb7 [0103.626] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml.H5QNPV28UkJG4U4fruBt0A==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml.H5QNPV28UkJG4U4fruBt0A==.bwall", lpFilePart=0x0) returned 0xa3 [0103.626] GetLastError () returned 0xb7 [0103.626] SetErrorMode (uMode=0x1) returned 0x0 [0103.627] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml.H5QNPV28UkJG4U4fruBt0A==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml.h5qnpv28ukjg4u4frubt0a==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0103.627] GetLastError () returned 0x0 [0103.627] GetFileType (hFile=0x3f4) returned 0x1 [0103.627] SetErrorMode (uMode=0x0) returned 0x1 [0103.627] GetFileType (hFile=0x3f4) returned 0x1 [0103.627] WriteFile (in: hFile=0x3f4, lpBuffer=0x2a72990*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x8fe920, lpOverlapped=0x0 | out: lpBuffer=0x2a72990*, lpNumberOfBytesWritten=0x8fe920*=0xcf0, lpOverlapped=0x0) returned 1 [0103.628] GetLastError () returned 0x0 [0103.628] CloseHandle (hObject=0x3f4) returned 1 [0103.628] GetLastError () returned 0x0 [0103.628] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", nBufferLength=0x105, lpBuffer=0x8fe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", lpFilePart=0x0) returned 0x84 [0103.628] GetLastError () returned 0x0 [0103.629] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml")) returned 1 [0103.629] GetLastError () returned 0x0 [0103.630] GetProcessWindowStation () returned 0x13c [0103.630] GetActiveWindow () returned 0x7002e [0103.630] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0103.630] GetCurrentThreadId () returned 0x540 [0103.630] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4d7a, lParam=0x0) returned 1 [0103.630] IsWindowVisible (hWnd=0x7002e) returned 0 [0103.633] IsWindowVisible (hWnd=0x4020e) returned 0 [0103.633] IsWindowVisible (hWnd=0x60044) returned 0 [0103.634] IsWindowVisible (hWnd=0x2021a) returned 0 [0103.634] IsWindowVisible (hWnd=0x8004a) returned 0 [0103.634] GetActiveWindow () returned 0x7002e [0103.634] GetFocus () returned 0x7002e [0103.634] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0103.635] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0103.635] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0103.636] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0103.636] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0103.636] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0103.637] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0103.643] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x77020c) returned 0x1 [0103.643] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0103.644] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0103.857] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0103.864] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0103.864] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0103.864] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x77020c) returned 0x1 [0103.869] SetFocus (hWnd=0x7002e) returned 0x77020c [0103.870] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0103.871] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0103.872] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0103.872] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0103.872] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x77020c, lParam=0x0) returned 0x0 [0103.876] IsWindow (hWnd=0x7002e) returned 1 [0103.876] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0103.876] IsWindow (hWnd=0x7002e) returned 1 [0103.876] SetFocus (hWnd=0x7002e) returned 0x7002e [0103.876] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0103.876] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0103.877] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0103.877] GetProcessWindowStation () returned 0x13c [0103.877] GetActiveWindow () returned 0x7002e [0103.877] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0103.877] GetCurrentThreadId () returned 0x540 [0103.877] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4b3a, lParam=0x0) returned 1 [0103.877] IsWindowVisible (hWnd=0x7002e) returned 0 [0103.878] IsWindowVisible (hWnd=0x4020e) returned 0 [0103.878] IsWindowVisible (hWnd=0x60044) returned 0 [0103.878] IsWindowVisible (hWnd=0x2021a) returned 0 [0103.878] IsWindowVisible (hWnd=0x8004a) returned 0 [0103.878] GetActiveWindow () returned 0x7002e [0103.878] GetFocus () returned 0x7002e [0103.878] MessageBoxW (hWnd=0x7002e, lpText="m9E7MpnW68GGgI7HRNzSoA==", lpCaption="", uType=0x0) returned 1 [0103.879] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0103.879] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0103.880] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0103.880] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0103.880] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0103.883] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0103.889] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x78020c) returned 0x1 [0103.890] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0103.890] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0104.728] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0104.737] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0104.737] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0104.737] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x78020c) returned 0x1 [0104.739] SetFocus (hWnd=0x7002e) returned 0x78020c [0104.744] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0104.746] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0104.746] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0104.747] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0104.747] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x78020c, lParam=0x0) returned 0x0 [0104.751] IsWindow (hWnd=0x7002e) returned 1 [0104.751] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0104.751] IsWindow (hWnd=0x7002e) returned 1 [0104.751] SetFocus (hWnd=0x7002e) returned 0x7002e [0104.751] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0104.751] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0104.751] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0104.751] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", lpFilePart=0x0) returned 0x81 [0104.751] GetLastError () returned 0x0 [0104.751] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", dwFileAttributes=0x80) returned 1 [0104.753] GetLastError () returned 0x0 [0104.753] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", lpFilePart=0x0) returned 0x81 [0104.753] GetLastError () returned 0x0 [0104.753] SetErrorMode (uMode=0x1) returned 0x0 [0104.753] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0104.753] GetLastError () returned 0x0 [0104.753] GetFileType (hFile=0x3f4) returned 0x1 [0104.753] SetErrorMode (uMode=0x0) returned 0x1 [0104.753] GetFileType (hFile=0x3f4) returned 0x1 [0104.753] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x8fe9a4 | out: lpFileSizeHigh=0x8fe9a4*=0x0) returned 0xca6 [0104.753] GetLastError () returned 0x0 [0104.753] ReadFile (in: hFile=0x3f4, lpBuffer=0x2a794a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe94c, lpOverlapped=0x0 | out: lpBuffer=0x2a794a0*, lpNumberOfBytesRead=0x8fe94c*=0xca6, lpOverlapped=0x0) returned 1 [0104.755] GetLastError () returned 0x0 [0104.755] CloseHandle (hObject=0x3f4) returned 1 [0104.755] GetLastError () returned 0x0 [0104.755] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0104.755] GetLastError () returned 0x0 [0104.755] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8f4 | out: phKey=0x8fe8f4*=0x9f6560) returned 1 [0104.755] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0104.755] GetLastError () returned 0x0 [0104.755] CryptSetKeyParam (hKey=0x9f6560, dwParam=0x4, pbData=0x2a7a514*=0x1, dwFlags=0x0) returned 1 [0104.755] GetLastError () returned 0x0 [0104.755] CryptSetKeyParam (hKey=0x9f6560, dwParam=0x1, pbData=0x2a7a4e0, dwFlags=0x0) returned 1 [0104.755] GetLastError () returned 0x0 [0104.755] CryptEncrypt (in: hKey=0x9f6560, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2a7a524*, pdwDataLen=0x8fe9ac*=0xcb0, dwBufLen=0xcb0 | out: pbData=0x2a7a524*, pdwDataLen=0x8fe9ac*=0xcb0) returned 1 [0104.755] GetLastError () returned 0x0 [0104.758] CryptEncrypt (in: hKey=0x9f6560, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2a7b1f4*, pdwDataLen=0x8fe9b4*=0x0, dwBufLen=0x10 | out: pbData=0x2a7b1f4*, pdwDataLen=0x8fe9b4*=0x10) returned 1 [0104.758] GetLastError () returned 0x0 [0104.758] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", lpFilePart=0x0) returned 0x81 [0104.758] GetLastError () returned 0x0 [0104.758] SetErrorMode (uMode=0x1) returned 0x0 [0104.758] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0104.759] GetLastError () returned 0xb7 [0104.759] GetFileType (hFile=0x3f4) returned 0x1 [0104.759] SetErrorMode (uMode=0x0) returned 0x1 [0104.759] GetFileType (hFile=0x3f4) returned 0x1 [0104.759] WriteFile (in: hFile=0x3f4, lpBuffer=0x2a7b6c0*, nNumberOfBytesToWrite=0xcb0, lpNumberOfBytesWritten=0x8fe920, lpOverlapped=0x0 | out: lpBuffer=0x2a7b6c0*, lpNumberOfBytesWritten=0x8fe920*=0xcb0, lpOverlapped=0x0) returned 1 [0104.760] GetLastError () returned 0xb7 [0104.760] CloseHandle (hObject=0x3f4) returned 1 [0104.761] GetLastError () returned 0xb7 [0104.761] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml.m9E7MpnW68GGgI7HRNzSoA==.bwall", nBufferLength=0x105, lpBuffer=0x8fe3f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml.m9E7MpnW68GGgI7HRNzSoA==.bwall", lpFilePart=0x0) returned 0xa0 [0104.761] GetLastError () returned 0xb7 [0104.761] SetErrorMode (uMode=0x1) returned 0x0 [0104.761] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml.m9E7MpnW68GGgI7HRNzSoA==.bwall" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml.m9e7mpnw68gggi7hrnzsoa==.bwall"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0104.761] GetLastError () returned 0x0 [0104.762] GetFileType (hFile=0x3f4) returned 0x1 [0104.762] SetErrorMode (uMode=0x0) returned 0x1 [0104.762] GetFileType (hFile=0x3f4) returned 0x1 [0104.762] WriteFile (in: hFile=0x3f4, lpBuffer=0x2a7ca30*, nNumberOfBytesToWrite=0xcb0, lpNumberOfBytesWritten=0x8fe920, lpOverlapped=0x0 | out: lpBuffer=0x2a7ca30*, lpNumberOfBytesWritten=0x8fe920*=0xcb0, lpOverlapped=0x0) returned 1 [0104.763] GetLastError () returned 0x0 [0104.763] CloseHandle (hObject=0x3f4) returned 1 [0104.763] GetLastError () returned 0x0 [0104.763] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", nBufferLength=0x105, lpBuffer=0x8fe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", lpFilePart=0x0) returned 0x81 [0104.763] GetLastError () returned 0x0 [0104.763] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml")) returned 1 [0104.764] GetLastError () returned 0x0 [0104.764] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpFilePart=0x0) returned 0x4e [0104.764] GetLastError () returned 0x0 [0104.765] SetErrorMode (uMode=0x1) returned 0x0 [0104.765] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0xedcf5d49, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f65a0 [0104.765] GetLastError () returned 0x0 [0104.765] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0xedcf5d49, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.765] GetLastError () returned 0x0 [0104.766] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437adb83, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x437adb83, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x247ecc35, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x44e23, dwReserved0=0x0, dwReserved1=0x0, cFileName="AirSpace.Etw.man", cAlternateFileName="AIRSPA~1.MAN")) returned 1 [0104.766] GetLastError () returned 0x0 [0104.766] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6c7b270, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xd6c7b270, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xd6c7b270, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x9200, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Access.Access.x-none.msi.16.x-none.xml.sO8000IXLYHiLxG7GDBDVw==.bwall", cAlternateFileName="C2RMAN~1.BWA")) returned 1 [0104.766] GetLastError () returned 0x0 [0104.766] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd70a7709, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xd70a7709, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xd70cd85a, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0xe720, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.accessmui.msi.16.en-us.xml.2wb3fAD8mFj8c4Ka#Z8XPw==.bwall", cAlternateFileName="C2RMAN~2.BWA")) returned 1 [0104.766] GetLastError () returned 0x0 [0104.766] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd743acb7, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xd743acb7, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xd7460fa6, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.accessmuiset.msi.16.en-us.xml.+4ic7kggLdSV3rCia30zgw==.bwall", cAlternateFileName="C2RMAN~3.BWA")) returned 1 [0104.766] GetLastError () returned 0x0 [0104.766] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7840c2e, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xd7840c2e, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xd7840c2e, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x3f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.FFv92suGiV1lwzj85lU2Sg==.bwall", cAlternateFileName="C2RMAN~4.BWA")) returned 1 [0104.767] GetLastError () returned 0x0 [0104.767] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7c6cec4, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xd7c6cec4, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xd7c6cec4, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x2660, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.dcfmui.msi.16.en-us.xml.j+wGaTu+tSy1a7DK3x6HhQ==.bwall", cAlternateFileName="C2A8F4~1.BWA")) returned 1 [0104.767] GetLastError () returned 0x0 [0104.767] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd840665d, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xd840665d, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xd840665d, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x39da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.g3#5SQ3oV3d6E8DhVoKtCA==.bwall", cAlternateFileName="C2D008~1.BWA")) returned 1 [0104.767] GetLastError () returned 0x0 [0104.767] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8ae1207, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xd8ae1207, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xd8b074b0, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x8f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.excelmui.msi.16.en-us.xml.kFPQxPKemMuM7hDViu5onA==.bwall", cAlternateFileName="C250B7~1.BWA")) returned 1 [0104.767] GetLastError () returned 0x0 [0104.767] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd922e586, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xd922e586, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xd922e586, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x8f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml.Hy5Nqj#nh341Dllfpk0mHQ==.bwall", cAlternateFileName="C23ACC~1.BWA")) returned 1 [0104.767] GetLastError () returned 0x0 [0104.768] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd98244f9, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xd98244f9, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xd98244f9, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x1810, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.groovemui.msi.16.en-us.xml.UCtjL#miOowWtzeFHpm7vQ==.bwall", cAlternateFileName="C24859~1.BWA")) returned 1 [0104.768] GetLastError () returned 0x0 [0104.768] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9c7680d, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xd9c7680d, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xd9c9d4c0, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x197a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.r1d9h1tx#xfizLncdH0cnQ==.bwall", cAlternateFileName="C29081~1.BWA")) returned 1 [0104.768] GetLastError () returned 0x0 [0104.768] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda187791, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xda187791, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xda187791, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x5ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.lyncmui.msi.16.en-us.xml.#MEA#7RdBVdZaxHPgVOEGw==.bwall", cAlternateFileName="C2BDF3~1.BWA")) returned 1 [0104.768] GetLastError () returned 0x0 [0104.768] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda4f4db2, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xda4f4db2, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xda4f4db2, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x6b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.office32mui.msi.16.en-us.xml.KjG+a0QcWnj1TMFH1VmKCg==.bwall", cAlternateFileName="C23666~1.BWA")) returned 1 [0104.768] GetLastError () returned 0x0 [0104.768] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdaa0a9ca, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xdaa0a9ca, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xdaa2d8f6, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x4f400, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.office32ww.msi.16.x-none.xml.Vvk4Am33q21#lgjSYBi9KA==.bwall", cAlternateFileName="C244EA~1.BWA")) returned 1 [0104.768] GetLastError () returned 0x0 [0104.769] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdaea4669, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xdaea4669, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xdaea4669, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x19880, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.officemui.msi.16.en-us.xml.M1igYQZjyGyq4DOB#BiTvg==.bwall", cAlternateFileName="C23E51~1.BWA")) returned 1 [0104.769] GetLastError () returned 0x0 [0104.769] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb284399, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xdb284399, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xdb284399, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.officemuiset.msi.16.en-us.xml.09kiW8wQhlJwyj55fuGyLg==.bwall", cAlternateFileName="C20741~1.BWA")) returned 1 [0104.769] GetLastError () returned 0x0 [0104.769] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde82943a, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xde82943a, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xde82943a, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x17b40, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.eJ+khozmXgZ#KPFJyf+jRA==.bwall", cAlternateFileName="C2CE22~1.BWA")) returned 1 [0104.769] GetLastError () returned 0x0 [0104.769] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f4b867, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xe1f4b867, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xe1f4b867, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x4a50, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.onenotemui.msi.16.en-us.xml.B0xrOF1SVX7sFhJLVkzkyg==.bwall", cAlternateFileName="C28313~1.BWA")) returned 1 [0104.769] GetLastError () returned 0x0 [0104.770] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe25678dc, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xe25678dc, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xe25678dc, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.dotz26ZiORj+WOUIEQZ7KQ==.bwall", cAlternateFileName="C275F5~1.BWA")) returned 1 [0104.770] GetLastError () returned 0x0 [0104.770] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a2c3e3, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xe2a2c3e3, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xe2a525d5, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x2b30, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.osmmui.msi.16.en-us.xml.jUrvQbMSJBXV4jWRQlRqXA==.bwall", cAlternateFileName="C2775A~1.BWA")) returned 1 [0104.770] GetLastError () returned 0x0 [0104.770] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e32363, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xe2e32363, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xe2e32363, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x910, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.J+mNCaJSj38MCeKF6sIt2Q==.bwall", cAlternateFileName="C20BA6~1.BWA")) returned 1 [0104.770] GetLastError () returned 0x0 [0104.770] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe35f1dc2, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xe35f1dc2, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xe35f1dc2, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x2b90, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.osmuxmui.msi.16.en-us.xml.+5Edj42nWkBw#z34X7rk3w==.bwall", cAlternateFileName="C2445E~1.BWA")) returned 1 [0104.770] GetLastError () returned 0x0 [0104.770] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe39ab8ad, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xe39ab8ad, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xe39d1b0d, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x171a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.sKC6WU2y6SDubZzrkGSf2A==.bwall", cAlternateFileName="C227E4~1.BWA")) returned 1 [0104.770] GetLastError () returned 0x0 [0104.771] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3db1835, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xe3db1835, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xe3dd7ac5, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x17990, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.outlookmui.msi.16.en-us.xml.YJ+jWl71QjHb#PkljWDEdw==.bwall", cAlternateFileName="C2024A~1.BWA")) returned 1 [0104.771] GetLastError () returned 0x0 [0104.771] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe44b4b33, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xe44b4b33, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xe44d8bb5, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0xafde0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.hRFPkHdQc+zxsTaOmdZ9Tg==.bwall", cAlternateFileName="C27D19~1.BWA")) returned 1 [0104.771] GetLastError () returned 0x0 [0104.773] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b8d6df, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xe4b8d6df, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xe4b8d6df, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x195b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.8sWR6Urc9LTEee0oIUjGtQ==.bwall", cAlternateFileName="C21C1E~1.BWA")) returned 1 [0104.773] GetLastError () returned 0x0 [0104.773] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4f6d00d, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xe4f6d00d, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xe4f6d00d, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x68a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.powerpointmui.msi.16.en-us.xml.FZOVCRKWtP#CT6Deb8LvXw==.bwall", cAlternateFileName="C21F5D~1.BWA")) returned 1 [0104.773] GetLastError () returned 0x0 [0104.773] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe534cd3a, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xe534cd3a, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xe534cd3a, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x7450, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Project.Project.x-none.msi.16.x-none.xml.8U3rUcsG5nZQzFyhS+Ayxg==.bwall", cAlternateFileName="C2ADC5~1.BWA")) returned 1 [0104.773] GetLastError () returned 0x0 [0104.773] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe572cfe7, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xe572cfe7, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xe572cfe7, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x80a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.projectmui.msi.16.en-us.xml.WKiyAWAi1tFV+JEAuspvbQ==.bwall", cAlternateFileName="C23CC3~1.BWA")) returned 1 [0104.773] GetLastError () returned 0x0 [0104.774] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5b0c745, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xe5b0c745, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xe5b0c745, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x63b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Proof.Culture.msi.16.en-us.xml.fp+Nk3VSMfKkivZsvcw58w==.bwall", cAlternateFileName="C25722~1.BWA")) returned 1 [0104.774] GetLastError () returned 0x0 [0104.774] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6069be6, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xe6069be6, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xe6069be6, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x5ff0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Proof.Culture.msi.16.es-es.xml.ZD5F20moI2Viumn4dikMZg==.bwall", cAlternateFileName="C2351B~1.BWA")) returned 1 [0104.774] GetLastError () returned 0x0 [0104.774] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe64bbff9, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xe64bbff9, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xe64bbff9, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x5ff0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Proof.Culture.msi.16.fr-fr.xml.UojXTGEJE#9#o22FD2dh0g==.bwall", cAlternateFileName="C25551~1.BWA")) returned 1 [0104.774] GetLastError () returned 0x0 [0104.774] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6b96c43, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xe6b96c43, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xe6b96c43, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.proofing.msi.16.en-us.xml.4tIp0dxJzuu98Uqf#UTLgQ==.bwall", cAlternateFileName="C2518B~1.BWA")) returned 1 [0104.774] GetLastError () returned 0x0 [0104.775] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6f04294, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xe6f04294, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xe6f04294, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x12e50, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml.8sMZRDjZp5VbxSNXuoTfLQ==.bwall", cAlternateFileName="C29C03~1.BWA")) returned 1 [0104.775] GetLastError () returned 0x0 [0104.775] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb768c8b, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xeb768c8b, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xeb768c8b, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x3740, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.publishermui.msi.16.en-us.xml.AYhnhMErssde51faj3hUJQ==.bwall", cAlternateFileName="C2FEC6~1.BWA")) returned 1 [0104.775] GetLastError () returned 0x0 [0104.775] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebc35ceb, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xebc35ceb, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xebc53aa8, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0xb27f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.shared.Office.x-none.msi.16.x-none.xml.MjyPYYKz1x225xGjFDRx+A==.bwall", cAlternateFileName="C248B1~1.BWA")) returned 1 [0104.775] GetLastError () returned 0x0 [0104.775] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec0a614e, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xec0a614e, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xec0cc2ea, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x2ab00, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml.L5qSovTDAGixIY6u0jJoxw==.bwall", cAlternateFileName="C2DC76~1.BWA")) returned 1 [0104.775] GetLastError () returned 0x0 [0104.775] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec64fa4d, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xec64fa4d, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xec6c8cd0, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0xf0cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.visiomui.msi.16.en-us.xml.l6J#RQN28vkZcXcYZZcrrQ==.bwall", cAlternateFileName="C2AA08~1.BWA")) returned 1 [0104.775] GetLastError () returned 0x0 [0104.776] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecaee71a, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xecaee71a, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xecb14321, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x15370, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Word.Word.x-none.msi.16.x-none.xml.AEBfCjhXq4rNsSd0BeyX2w==.bwall", cAlternateFileName="C2B326~1.BWA")) returned 1 [0104.776] GetLastError () returned 0x0 [0104.776] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece5b67e, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xece5b67e, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xece5b67e, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0x13100, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.wordmui.msi.16.en-us.xml.yKFbC#WYb2JTYDE#IX4GFA==.bwall", cAlternateFileName="C21806~1.BWA")) returned 1 [0104.776] GetLastError () returned 0x0 [0104.776] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x49bee514, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xd2dfa2a2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12c470, dwReserved0=0x0, dwReserved1=0x0, cFileName="integrator.exe", cAlternateFileName="INTEGR~1.EXE")) returned 1 [0104.776] GetLastError () returned 0x0 [0104.776] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed21512f, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xed21512f, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xed21512f, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0xcf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml.H5QNPV28UkJG4U4fruBt0A==.bwall", cAlternateFileName="MICROS~1.BWA")) returned 1 [0104.776] GetLastError () returned 0x0 [0104.776] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcf5d49, ftCreationTime.dwHighDateTime=0x1d57614, ftLastAccessTime.dwLowDateTime=0xedcf5d49, ftLastAccessTime.dwHighDateTime=0x1d57614, ftLastWriteTime.dwLowDateTime=0xedcf5d49, ftLastWriteTime.dwHighDateTime=0x1d57614, nFileSizeHigh=0x0, nFileSizeLow=0xcb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml.m9E7MpnW68GGgI7HRNzSoA==.bwall", cAlternateFileName="MICROS~2.BWA")) returned 1 [0104.777] GetLastError () returned 0x0 [0104.777] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x433f4072, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x433f4072, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x1bd7df5e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1b826, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoutilstat.etw.man", cAlternateFileName="MSOUTI~1.MAN")) returned 1 [0104.777] GetLastError () returned 0x0 [0104.777] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42b4f7c0, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x42b4f7c0, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x244f1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9bddd, dwReserved0=0x0, dwReserved1=0x0, cFileName="wordEtw.man", cAlternateFileName="")) returned 1 [0104.777] GetLastError () returned 0x0 [0104.777] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42b4f7c0, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x42b4f7c0, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x244f1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9bddd, dwReserved0=0x0, dwReserved1=0x0, cFileName="wordEtw.man", cAlternateFileName="")) returned 0 [0104.777] GetLastError () returned 0x12 [0104.777] FindClose (in: hFindFile=0x9f65a0 | out: hFindFile=0x9f65a0) returned 1 [0104.777] SetErrorMode (uMode=0x0) returned 0x1 [0104.778] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x61 [0104.778] GetLastError () returned 0x12 [0104.778] SetErrorMode (uMode=0x1) returned 0x0 [0104.779] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3f4 [0104.779] GetLastError () returned 0x0 [0104.779] GetFileType (hFile=0x3f4) returned 0x1 [0104.779] SetErrorMode (uMode=0x0) returned 0x1 [0104.779] GetFileType (hFile=0x3f4) returned 0x1 [0104.779] WriteFile (in: hFile=0x3f4, lpBuffer=0x2a91b54*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe968, lpOverlapped=0x0 | out: lpBuffer=0x2a91b54*, lpNumberOfBytesWritten=0x8fe968*=0xbcb, lpOverlapped=0x0) returned 1 [0104.780] GetLastError () returned 0x0 [0104.780] CloseHandle (hObject=0x3f4) returned 1 [0104.780] GetLastError () returned 0x0 [0104.781] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x3a [0104.781] GetLastError () returned 0x0 [0104.781] SetErrorMode (uMode=0x1) returned 0x0 [0104.781] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3f4 [0104.781] GetLastError () returned 0x0 [0104.781] GetFileType (hFile=0x3f4) returned 0x1 [0104.781] SetErrorMode (uMode=0x0) returned 0x1 [0104.781] GetFileType (hFile=0x3f4) returned 0x1 [0104.781] WriteFile (in: hFile=0x3f4, lpBuffer=0x2a98828*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe99c, lpOverlapped=0x0 | out: lpBuffer=0x2a98828*, lpNumberOfBytesWritten=0x8fe99c*=0xbcb, lpOverlapped=0x0) returned 1 [0104.782] GetLastError () returned 0x0 [0104.782] CloseHandle (hObject=0x3f4) returned 1 [0104.782] GetLastError () returned 0x0 [0104.782] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x8fe508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x23 [0104.783] GetLastError () returned 0x0 [0104.783] SetErrorMode (uMode=0x1) returned 0x0 [0104.783] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f65a0 [0104.783] GetLastError () returned 0x0 [0104.783] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.783] GetLastError () returned 0x0 [0104.783] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x42e812c9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x42e812c9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DSS", cAlternateFileName="")) returned 1 [0104.783] GetLastError () returned 0x0 [0104.783] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Keys", cAlternateFileName="")) returned 1 [0104.784] GetLastError () returned 0x0 [0104.784] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x416372c8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x416372c8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PCPKSP", cAlternateFileName="")) returned 1 [0104.784] GetLastError () returned 0x0 [0104.784] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x17c6f037, ftLastAccessTime.dwHighDateTime=0x1d2a02b, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 1 [0104.784] GetLastError () returned 0x0 [0104.784] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xfe648d52, ftLastWriteTime.dwHighDateTime=0x1d32770, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemKeys", cAlternateFileName="SYSTEM~1")) returned 1 [0104.784] GetLastError () returned 0x0 [0104.784] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xfe648d52, ftLastWriteTime.dwHighDateTime=0x1d32770, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemKeys", cAlternateFileName="SYSTEM~1")) returned 0 [0104.784] GetLastError () returned 0x12 [0104.785] FindClose (in: hFindFile=0x9f65a0 | out: hFindFile=0x9f65a0) returned 1 [0104.785] SetErrorMode (uMode=0x0) returned 0x1 [0104.785] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x8fe508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x23 [0104.785] GetLastError () returned 0x12 [0104.785] SetErrorMode (uMode=0x1) returned 0x0 [0104.785] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6160 [0104.785] GetLastError () returned 0x12 [0104.785] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.785] GetLastError () returned 0x12 [0104.785] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x42e812c9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x42e812c9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DSS", cAlternateFileName="")) returned 1 [0104.785] GetLastError () returned 0x12 [0104.785] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Keys", cAlternateFileName="")) returned 1 [0104.785] GetLastError () returned 0x12 [0104.786] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x416372c8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x416372c8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PCPKSP", cAlternateFileName="")) returned 1 [0104.786] GetLastError () returned 0x12 [0104.786] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x17c6f037, ftLastAccessTime.dwHighDateTime=0x1d2a02b, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 1 [0104.786] GetLastError () returned 0x12 [0104.786] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xfe648d52, ftLastWriteTime.dwHighDateTime=0x1d32770, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemKeys", cAlternateFileName="SYSTEM~1")) returned 1 [0104.786] GetLastError () returned 0x12 [0104.786] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xfe648d52, ftLastWriteTime.dwHighDateTime=0x1d32770, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemKeys", cAlternateFileName="SYSTEM~1")) returned 0 [0104.786] GetLastError () returned 0x12 [0104.786] FindClose (in: hFindFile=0x9f6160 | out: hFindFile=0x9f6160) returned 1 [0104.786] SetErrorMode (uMode=0x0) returned 0x1 [0104.786] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS", lpFilePart=0x0) returned 0x27 [0104.786] GetLastError () returned 0x12 [0104.786] SetErrorMode (uMode=0x1) returned 0x0 [0104.786] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x42e812c9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x42e812c9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f66a0 [0104.787] GetLastError () returned 0x12 [0104.787] FindNextFileW (in: hFindFile=0x9f66a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x42e812c9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x42e812c9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.787] GetLastError () returned 0x12 [0104.787] FindNextFileW (in: hFindFile=0x9f66a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1 [0104.787] GetLastError () returned 0x12 [0104.787] FindNextFileW (in: hFindFile=0x9f66a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 0 [0104.788] GetLastError () returned 0x12 [0104.788] FindClose (in: hFindFile=0x9f66a0 | out: hFindFile=0x9f66a0) returned 1 [0104.788] SetErrorMode (uMode=0x0) returned 0x1 [0104.788] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS", lpFilePart=0x0) returned 0x27 [0104.788] GetLastError () returned 0x12 [0104.788] SetErrorMode (uMode=0x1) returned 0x0 [0104.788] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x42e812c9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x42e812c9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f61a0 [0104.788] GetLastError () returned 0x12 [0104.788] FindNextFileW (in: hFindFile=0x9f61a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x42e812c9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x42e812c9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.788] GetLastError () returned 0x12 [0104.788] FindNextFileW (in: hFindFile=0x9f61a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1 [0104.788] GetLastError () returned 0x12 [0104.788] FindNextFileW (in: hFindFile=0x9f61a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 0 [0104.789] GetLastError () returned 0x12 [0104.789] FindClose (in: hFindFile=0x9f61a0 | out: hFindFile=0x9f61a0) returned 1 [0104.789] SetErrorMode (uMode=0x0) returned 0x1 [0104.789] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys", lpFilePart=0x0) returned 0x33 [0104.789] GetLastError () returned 0x12 [0104.789] SetErrorMode (uMode=0x1) returned 0x0 [0104.789] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f60a0 [0104.790] GetLastError () returned 0x12 [0104.790] FindNextFileW (in: hFindFile=0x9f60a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.790] GetLastError () returned 0x12 [0104.790] FindNextFileW (in: hFindFile=0x9f60a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0104.790] GetLastError () returned 0x12 [0104.790] FindClose (in: hFindFile=0x9f60a0 | out: hFindFile=0x9f60a0) returned 1 [0104.790] SetErrorMode (uMode=0x0) returned 0x1 [0104.790] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys", lpFilePart=0x0) returned 0x33 [0104.790] GetLastError () returned 0x12 [0104.790] SetErrorMode (uMode=0x1) returned 0x0 [0104.790] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6720 [0104.790] GetLastError () returned 0x12 [0104.790] FindNextFileW (in: hFindFile=0x9f6720, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.790] GetLastError () returned 0x12 [0104.791] FindNextFileW (in: hFindFile=0x9f6720, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0104.791] GetLastError () returned 0x12 [0104.791] FindClose (in: hFindFile=0x9f6720 | out: hFindFile=0x9f6720) returned 1 [0104.791] SetErrorMode (uMode=0x0) returned 0x1 [0104.791] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe3dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x46 [0104.791] GetLastError () returned 0x12 [0104.791] SetErrorMode (uMode=0x1) returned 0x0 [0104.791] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\machinekeys\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3f4 [0104.792] GetLastError () returned 0x0 [0104.792] GetFileType (hFile=0x3f4) returned 0x1 [0104.792] SetErrorMode (uMode=0x0) returned 0x1 [0104.792] GetFileType (hFile=0x3f4) returned 0x1 [0104.792] WriteFile (in: hFile=0x3f4, lpBuffer=0x2aa1edc*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe934, lpOverlapped=0x0 | out: lpBuffer=0x2aa1edc*, lpNumberOfBytesWritten=0x8fe934*=0xbcb, lpOverlapped=0x0) returned 1 [0104.793] GetLastError () returned 0x0 [0104.793] CloseHandle (hObject=0x3f4) returned 1 [0104.793] GetLastError () returned 0x0 [0104.794] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x3a [0104.794] GetLastError () returned 0x0 [0104.794] SetErrorMode (uMode=0x1) returned 0x0 [0104.794] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3f4 [0104.794] GetLastError () returned 0x0 [0104.794] GetFileType (hFile=0x3f4) returned 0x1 [0104.794] SetErrorMode (uMode=0x0) returned 0x1 [0104.794] GetFileType (hFile=0x3f4) returned 0x1 [0104.794] WriteFile (in: hFile=0x3f4, lpBuffer=0x2aa8bb0*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe968, lpOverlapped=0x0 | out: lpBuffer=0x2aa8bb0*, lpNumberOfBytesWritten=0x8fe968*=0xbcb, lpOverlapped=0x0) returned 1 [0104.795] GetLastError () returned 0x0 [0104.795] CloseHandle (hObject=0x3f4) returned 1 [0104.795] GetLastError () returned 0x0 [0104.796] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys", lpFilePart=0x0) returned 0x28 [0104.796] GetLastError () returned 0x0 [0104.796] SetErrorMode (uMode=0x1) returned 0x0 [0104.796] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f62e0 [0104.796] GetLastError () returned 0x0 [0104.796] FindNextFileW (in: hFindFile=0x9f62e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.796] GetLastError () returned 0x0 [0104.797] FindNextFileW (in: hFindFile=0x9f62e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0104.797] GetLastError () returned 0x12 [0104.797] FindClose (in: hFindFile=0x9f62e0 | out: hFindFile=0x9f62e0) returned 1 [0104.797] SetErrorMode (uMode=0x0) returned 0x1 [0104.797] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys", lpFilePart=0x0) returned 0x28 [0104.797] GetLastError () returned 0x12 [0104.797] SetErrorMode (uMode=0x1) returned 0x0 [0104.797] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f62e0 [0104.797] GetLastError () returned 0x12 [0104.797] FindNextFileW (in: hFindFile=0x9f62e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.797] GetLastError () returned 0x12 [0104.797] FindNextFileW (in: hFindFile=0x9f62e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0104.797] GetLastError () returned 0x12 [0104.798] FindClose (in: hFindFile=0x9f62e0 | out: hFindFile=0x9f62e0) returned 1 [0104.798] SetErrorMode (uMode=0x0) returned 0x1 [0104.798] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x3b [0104.798] GetLastError () returned 0x12 [0104.798] SetErrorMode (uMode=0x1) returned 0x0 [0104.798] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\keys\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3f4 [0104.799] GetLastError () returned 0x0 [0104.799] GetFileType (hFile=0x3f4) returned 0x1 [0104.799] SetErrorMode (uMode=0x0) returned 0x1 [0104.799] GetFileType (hFile=0x3f4) returned 0x1 [0104.799] WriteFile (in: hFile=0x3f4, lpBuffer=0x2ab0330*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe968, lpOverlapped=0x0 | out: lpBuffer=0x2ab0330*, lpNumberOfBytesWritten=0x8fe968*=0xbcb, lpOverlapped=0x0) returned 1 [0104.800] GetLastError () returned 0x0 [0104.800] CloseHandle (hObject=0x3f4) returned 1 [0104.800] GetLastError () returned 0x0 [0104.800] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP", lpFilePart=0x0) returned 0x2a [0104.800] GetLastError () returned 0x0 [0104.800] SetErrorMode (uMode=0x1) returned 0x0 [0104.800] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x416372c8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x416372c8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f62e0 [0104.801] GetLastError () returned 0x0 [0104.801] FindNextFileW (in: hFindFile=0x9f62e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x416372c8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x416372c8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.801] GetLastError () returned 0x0 [0104.801] FindNextFileW (in: hFindFile=0x9f62e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsAIK", cAlternateFileName="WINDOW~1")) returned 1 [0104.801] GetLastError () returned 0x0 [0104.801] FindNextFileW (in: hFindFile=0x9f62e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsAIK", cAlternateFileName="WINDOW~1")) returned 0 [0104.801] GetLastError () returned 0x12 [0104.801] FindClose (in: hFindFile=0x9f62e0 | out: hFindFile=0x9f62e0) returned 1 [0104.808] SetErrorMode (uMode=0x0) returned 0x1 [0104.808] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP", lpFilePart=0x0) returned 0x2a [0104.808] GetLastError () returned 0x12 [0104.808] SetErrorMode (uMode=0x1) returned 0x0 [0104.808] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x416372c8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x416372c8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f65a0 [0104.808] GetLastError () returned 0x12 [0104.808] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x416372c8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x416372c8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.808] GetLastError () returned 0x12 [0104.808] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsAIK", cAlternateFileName="WINDOW~1")) returned 1 [0104.809] GetLastError () returned 0x12 [0104.809] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsAIK", cAlternateFileName="WINDOW~1")) returned 0 [0104.809] GetLastError () returned 0x12 [0104.809] FindClose (in: hFindFile=0x9f65a0 | out: hFindFile=0x9f65a0) returned 1 [0104.809] SetErrorMode (uMode=0x0) returned 0x1 [0104.809] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK", lpFilePart=0x0) returned 0x35 [0104.809] GetLastError () returned 0x12 [0104.809] SetErrorMode (uMode=0x1) returned 0x0 [0104.809] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f65a0 [0104.809] GetLastError () returned 0x12 [0104.809] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.809] GetLastError () returned 0x12 [0104.810] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0104.810] GetLastError () returned 0x12 [0104.810] FindClose (in: hFindFile=0x9f65a0 | out: hFindFile=0x9f65a0) returned 1 [0104.810] SetErrorMode (uMode=0x0) returned 0x1 [0104.810] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK", lpFilePart=0x0) returned 0x35 [0104.810] GetLastError () returned 0x12 [0104.810] SetErrorMode (uMode=0x1) returned 0x0 [0104.810] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f65a0 [0104.810] GetLastError () returned 0x12 [0104.810] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.810] GetLastError () returned 0x12 [0104.810] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0104.810] GetLastError () returned 0x12 [0104.810] FindClose (in: hFindFile=0x9f65a0 | out: hFindFile=0x9f65a0) returned 1 [0104.811] SetErrorMode (uMode=0x0) returned 0x1 [0104.811] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe3dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x48 [0104.811] GetLastError () returned 0x12 [0104.811] SetErrorMode (uMode=0x1) returned 0x0 [0104.811] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\pcpksp\\windowsaik\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3f4 [0104.812] GetLastError () returned 0x0 [0104.812] GetFileType (hFile=0x3f4) returned 0x1 [0104.812] SetErrorMode (uMode=0x0) returned 0x1 [0104.812] GetFileType (hFile=0x3f4) returned 0x1 [0104.813] WriteFile (in: hFile=0x3f4, lpBuffer=0x2ab8a38*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe934, lpOverlapped=0x0 | out: lpBuffer=0x2ab8a38*, lpNumberOfBytesWritten=0x8fe934*=0xbcb, lpOverlapped=0x0) returned 1 [0104.813] GetLastError () returned 0x0 [0104.813] CloseHandle (hObject=0x3f4) returned 1 [0104.814] GetLastError () returned 0x0 [0104.814] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x3d [0104.814] GetLastError () returned 0x0 [0104.814] SetErrorMode (uMode=0x1) returned 0x0 [0104.814] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\pcpksp\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3f4 [0104.814] GetLastError () returned 0x0 [0104.814] GetFileType (hFile=0x3f4) returned 0x1 [0104.814] SetErrorMode (uMode=0x0) returned 0x1 [0104.815] GetFileType (hFile=0x3f4) returned 0x1 [0104.815] WriteFile (in: hFile=0x3f4, lpBuffer=0x2abf718*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe968, lpOverlapped=0x0 | out: lpBuffer=0x2abf718*, lpNumberOfBytesWritten=0x8fe968*=0xbcb, lpOverlapped=0x0) returned 1 [0104.815] GetLastError () returned 0x0 [0104.815] CloseHandle (hObject=0x3f4) returned 1 [0104.816] GetLastError () returned 0x0 [0104.816] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x27 [0104.816] GetLastError () returned 0x0 [0104.816] SetErrorMode (uMode=0x1) returned 0x0 [0104.816] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x17c6f037, ftLastAccessTime.dwHighDateTime=0x1d2a02b, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f65a0 [0104.816] GetLastError () returned 0x0 [0104.816] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x17c6f037, ftLastAccessTime.dwHighDateTime=0x1d2a02b, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.816] GetLastError () returned 0x0 [0104.816] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd40a02b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x955a3652, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1 [0104.816] GetLastError () returned 0x0 [0104.816] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0104.816] GetLastError () returned 0x0 [0104.817] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 0 [0104.817] GetLastError () returned 0x12 [0104.817] FindClose (in: hFindFile=0x9f65a0 | out: hFindFile=0x9f65a0) returned 1 [0104.817] SetErrorMode (uMode=0x0) returned 0x1 [0104.817] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x27 [0104.817] GetLastError () returned 0x12 [0104.817] SetErrorMode (uMode=0x1) returned 0x0 [0104.817] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f65a0 [0104.817] GetLastError () returned 0x12 [0104.817] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.817] GetLastError () returned 0x12 [0104.817] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd40a02b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x955a3652, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1 [0104.817] GetLastError () returned 0x12 [0104.818] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0104.818] GetLastError () returned 0x12 [0104.818] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 0 [0104.820] GetLastError () returned 0x12 [0104.820] FindClose (in: hFindFile=0x9f65a0 | out: hFindFile=0x9f65a0) returned 1 [0104.820] SetErrorMode (uMode=0x0) returned 0x1 [0104.820] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys", lpFilePart=0x0) returned 0x33 [0104.820] GetLastError () returned 0x12 [0104.820] SetErrorMode (uMode=0x1) returned 0x0 [0104.820] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd40a02b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x955a3652, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6660 [0104.821] GetLastError () returned 0x12 [0104.821] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd40a02b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x955a3652, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.821] GetLastError () returned 0x12 [0104.821] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcb806263, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb806263, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcbbe5f7c, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x8b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", cAlternateFileName="F686AA~1")) returned 1 [0104.821] GetLastError () returned 0x12 [0104.821] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcb806263, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb806263, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcbbe5f7c, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x8b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", cAlternateFileName="F686AA~1")) returned 0 [0104.821] GetLastError () returned 0x12 [0104.821] FindClose (in: hFindFile=0x9f6660 | out: hFindFile=0x9f6660) returned 1 [0104.821] SetErrorMode (uMode=0x0) returned 0x1 [0104.829] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys", lpFilePart=0x0) returned 0x33 [0104.829] GetLastError () returned 0x12 [0104.829] SetErrorMode (uMode=0x1) returned 0x0 [0104.829] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd40a02b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x955a3652, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6260 [0104.830] GetLastError () returned 0x12 [0104.830] FindNextFileW (in: hFindFile=0x9f6260, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd40a02b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x955a3652, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.830] GetLastError () returned 0x12 [0104.830] FindNextFileW (in: hFindFile=0x9f6260, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcb806263, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb806263, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcbbe5f7c, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x8b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", cAlternateFileName="F686AA~1")) returned 1 [0104.830] GetLastError () returned 0x12 [0104.830] FindNextFileW (in: hFindFile=0x9f6260, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcb806263, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb806263, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcbbe5f7c, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x8b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", cAlternateFileName="F686AA~1")) returned 0 [0104.830] GetLastError () returned 0x12 [0104.830] FindClose (in: hFindFile=0x9f6260 | out: hFindFile=0x9f6260) returned 1 [0104.830] SetErrorMode (uMode=0x0) returned 0x1 [0104.830] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe3dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x46 [0104.831] GetLastError () returned 0x12 [0104.831] SetErrorMode (uMode=0x1) returned 0x0 [0104.831] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3f4 [0104.831] GetLastError () returned 0x0 [0104.831] GetFileType (hFile=0x3f4) returned 0x1 [0104.831] SetErrorMode (uMode=0x0) returned 0x1 [0104.831] GetFileType (hFile=0x3f4) returned 0x1 [0104.831] WriteFile (in: hFile=0x3f4, lpBuffer=0x2acac80*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe934, lpOverlapped=0x0 | out: lpBuffer=0x2acac80*, lpNumberOfBytesWritten=0x8fe934*=0xbcb, lpOverlapped=0x0) returned 1 [0104.832] GetLastError () returned 0x0 [0104.832] CloseHandle (hObject=0x3f4) returned 1 [0104.833] GetLastError () returned 0x0 [0104.833] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18", lpFilePart=0x0) returned 0x30 [0104.833] GetLastError () returned 0x0 [0104.833] SetErrorMode (uMode=0x1) returned 0x0 [0104.833] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6260 [0104.833] GetLastError () returned 0x0 [0104.833] FindNextFileW (in: hFindFile=0x9f6260, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.833] GetLastError () returned 0x0 [0104.834] FindNextFileW (in: hFindFile=0x9f6260, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="4ECCD1~1")) returned 1 [0104.834] GetLastError () returned 0x0 [0104.834] FindNextFileW (in: hFindFile=0x9f6260, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="4ECCD1~1")) returned 0 [0104.834] GetLastError () returned 0x12 [0104.834] FindClose (in: hFindFile=0x9f6260 | out: hFindFile=0x9f6260) returned 1 [0104.835] SetErrorMode (uMode=0x0) returned 0x1 [0104.835] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18", lpFilePart=0x0) returned 0x30 [0104.835] GetLastError () returned 0x12 [0104.835] SetErrorMode (uMode=0x1) returned 0x0 [0104.835] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f65a0 [0104.835] GetLastError () returned 0x12 [0104.835] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.835] GetLastError () returned 0x12 [0104.835] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="4ECCD1~1")) returned 1 [0104.835] GetLastError () returned 0x12 [0104.835] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="4ECCD1~1")) returned 0 [0104.835] GetLastError () returned 0x12 [0104.836] FindClose (in: hFindFile=0x9f65a0 | out: hFindFile=0x9f65a0) returned 1 [0104.836] SetErrorMode (uMode=0x0) returned 0x1 [0104.836] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe3dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x43 [0104.836] GetLastError () returned 0x12 [0104.836] SetErrorMode (uMode=0x1) returned 0x0 [0104.836] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3f4 [0104.836] GetLastError () returned 0x0 [0104.836] GetFileType (hFile=0x3f4) returned 0x1 [0104.836] SetErrorMode (uMode=0x0) returned 0x1 [0104.836] GetFileType (hFile=0x3f4) returned 0x1 [0104.836] WriteFile (in: hFile=0x3f4, lpBuffer=0x2ad5348*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe934, lpOverlapped=0x0 | out: lpBuffer=0x2ad5348*, lpNumberOfBytesWritten=0x8fe934*=0xbcb, lpOverlapped=0x0) returned 1 [0104.837] GetLastError () returned 0x0 [0104.837] CloseHandle (hObject=0x3f4) returned 1 [0104.838] GetLastError () returned 0x0 [0104.838] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x3a [0104.838] GetLastError () returned 0x0 [0104.838] SetErrorMode (uMode=0x1) returned 0x0 [0104.838] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3f4 [0104.841] GetLastError () returned 0x0 [0104.841] GetFileType (hFile=0x3f4) returned 0x1 [0104.841] SetErrorMode (uMode=0x0) returned 0x1 [0104.841] GetFileType (hFile=0x3f4) returned 0x1 [0104.841] WriteFile (in: hFile=0x3f4, lpBuffer=0x2adc01c*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe968, lpOverlapped=0x0 | out: lpBuffer=0x2adc01c*, lpNumberOfBytesWritten=0x8fe968*=0xbcb, lpOverlapped=0x0) returned 1 [0104.842] GetLastError () returned 0x0 [0104.842] CloseHandle (hObject=0x3f4) returned 1 [0104.842] GetLastError () returned 0x0 [0104.842] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys", lpFilePart=0x0) returned 0x2e [0104.842] GetLastError () returned 0x0 [0104.842] SetErrorMode (uMode=0x1) returned 0x0 [0104.842] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x7737cd02, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x7737cd02, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f66a0 [0104.843] GetLastError () returned 0x0 [0104.843] FindNextFileW (in: hFindFile=0x9f66a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x7737cd02, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x7737cd02, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.843] GetLastError () returned 0x0 [0104.843] FindNextFileW (in: hFindFile=0x9f66a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcc464582, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", cAlternateFileName="709228~1")) returned 1 [0104.843] GetLastError () returned 0x0 [0104.843] FindNextFileW (in: hFindFile=0x9f66a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x1b8875cb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x1b8875cb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x1b8875cb, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="D20D9E~1")) returned 1 [0104.843] GetLastError () returned 0x0 [0104.843] FindNextFileW (in: hFindFile=0x9f66a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x1b8875cb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x1b8875cb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x1b8875cb, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="D20D9E~1")) returned 0 [0104.843] GetLastError () returned 0x12 [0104.843] FindClose (in: hFindFile=0x9f66a0 | out: hFindFile=0x9f66a0) returned 1 [0104.843] SetErrorMode (uMode=0x0) returned 0x1 [0104.844] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys", lpFilePart=0x0) returned 0x2e [0104.844] GetLastError () returned 0x12 [0104.844] SetErrorMode (uMode=0x1) returned 0x0 [0104.844] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x7737cd02, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x7737cd02, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6660 [0104.844] GetLastError () returned 0x12 [0104.844] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x7737cd02, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x7737cd02, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.844] GetLastError () returned 0x12 [0104.844] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcc464582, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", cAlternateFileName="709228~1")) returned 1 [0104.844] GetLastError () returned 0x12 [0104.844] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x1b8875cb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x1b8875cb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x1b8875cb, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="D20D9E~1")) returned 1 [0104.844] GetLastError () returned 0x12 [0104.845] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x1b8875cb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x1b8875cb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x1b8875cb, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="D20D9E~1")) returned 0 [0104.845] GetLastError () returned 0x12 [0104.845] FindClose (in: hFindFile=0x9f6660 | out: hFindFile=0x9f6660) returned 1 [0104.845] SetErrorMode (uMode=0x0) returned 0x1 [0104.845] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x41 [0104.845] GetLastError () returned 0x12 [0104.845] SetErrorMode (uMode=0x1) returned 0x0 [0104.845] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3f4 [0104.845] GetLastError () returned 0x0 [0104.845] GetFileType (hFile=0x3f4) returned 0x1 [0104.846] SetErrorMode (uMode=0x0) returned 0x1 [0104.846] GetFileType (hFile=0x3f4) returned 0x1 [0104.846] WriteFile (in: hFile=0x3f4, lpBuffer=0x2ae91f4*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe968, lpOverlapped=0x0 | out: lpBuffer=0x2ae91f4*, lpNumberOfBytesWritten=0x8fe968*=0xbcb, lpOverlapped=0x0) returned 1 [0104.847] GetLastError () returned 0x0 [0104.847] CloseHandle (hObject=0x3f4) returned 1 [0104.847] GetLastError () returned 0x0 [0104.847] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x36 [0104.847] GetLastError () returned 0x0 [0104.847] SetErrorMode (uMode=0x1) returned 0x0 [0104.847] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3f4 [0104.849] GetLastError () returned 0x0 [0104.849] GetFileType (hFile=0x3f4) returned 0x1 [0104.849] SetErrorMode (uMode=0x0) returned 0x1 [0104.849] GetFileType (hFile=0x3f4) returned 0x1 [0104.851] WriteFile (in: hFile=0x3f4, lpBuffer=0x2aefeb8*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe99c, lpOverlapped=0x0 | out: lpBuffer=0x2aefeb8*, lpNumberOfBytesWritten=0x8fe99c*=0xbcb, lpOverlapped=0x0) returned 1 [0104.852] GetLastError () returned 0x0 [0104.852] CloseHandle (hObject=0x3f4) returned 1 [0104.852] GetLastError () returned 0x0 [0104.852] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DataMart", nBufferLength=0x105, lpBuffer=0x8fe508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DataMart", lpFilePart=0x0) returned 0x25 [0104.852] GetLastError () returned 0x0 [0104.852] SetErrorMode (uMode=0x1) returned 0x0 [0104.852] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DataMart\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f61e0 [0104.853] GetLastError () returned 0x0 [0104.853] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.853] GetLastError () returned 0x0 [0104.853] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PaidWiFi", cAlternateFileName="")) returned 1 [0104.853] GetLastError () returned 0x0 [0104.853] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PaidWiFi", cAlternateFileName="")) returned 0 [0104.853] GetLastError () returned 0x12 [0104.854] FindClose (in: hFindFile=0x9f61e0 | out: hFindFile=0x9f61e0) returned 1 [0104.854] SetErrorMode (uMode=0x0) returned 0x1 [0104.854] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DataMart", nBufferLength=0x105, lpBuffer=0x8fe508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DataMart", lpFilePart=0x0) returned 0x25 [0104.854] GetLastError () returned 0x12 [0104.854] SetErrorMode (uMode=0x1) returned 0x0 [0104.854] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DataMart\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6060 [0104.854] GetLastError () returned 0x12 [0104.854] FindNextFileW (in: hFindFile=0x9f6060, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.854] GetLastError () returned 0x12 [0104.854] FindNextFileW (in: hFindFile=0x9f6060, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PaidWiFi", cAlternateFileName="")) returned 1 [0104.854] GetLastError () returned 0x12 [0104.854] FindNextFileW (in: hFindFile=0x9f6060, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PaidWiFi", cAlternateFileName="")) returned 0 [0104.854] GetLastError () returned 0x12 [0104.855] FindClose (in: hFindFile=0x9f6060 | out: hFindFile=0x9f6060) returned 1 [0104.855] SetErrorMode (uMode=0x0) returned 0x1 [0104.855] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DataMart\\PaidWiFi", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DataMart\\PaidWiFi", lpFilePart=0x0) returned 0x2e [0104.855] GetLastError () returned 0x12 [0104.855] SetErrorMode (uMode=0x1) returned 0x0 [0104.855] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DataMart\\PaidWiFi\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f63a0 [0104.855] GetLastError () returned 0x12 [0104.855] FindNextFileW (in: hFindFile=0x9f63a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.855] GetLastError () returned 0x12 [0104.855] FindNextFileW (in: hFindFile=0x9f63a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0104.855] GetLastError () returned 0x12 [0104.855] FindClose (in: hFindFile=0x9f63a0 | out: hFindFile=0x9f63a0) returned 1 [0104.855] SetErrorMode (uMode=0x0) returned 0x1 [0104.855] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DataMart\\PaidWiFi", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DataMart\\PaidWiFi", lpFilePart=0x0) returned 0x2e [0104.856] GetLastError () returned 0x12 [0104.856] SetErrorMode (uMode=0x1) returned 0x0 [0104.856] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DataMart\\PaidWiFi\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6220 [0104.856] GetLastError () returned 0x12 [0104.856] FindNextFileW (in: hFindFile=0x9f6220, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.856] GetLastError () returned 0x12 [0104.856] FindNextFileW (in: hFindFile=0x9f6220, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0104.856] GetLastError () returned 0x12 [0104.856] FindClose (in: hFindFile=0x9f6220 | out: hFindFile=0x9f6220) returned 1 [0104.856] SetErrorMode (uMode=0x0) returned 0x1 [0104.856] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DataMart\\PaidWiFi\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DataMart\\PaidWiFi\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x41 [0104.856] GetLastError () returned 0x12 [0104.857] SetErrorMode (uMode=0x1) returned 0x0 [0104.857] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DataMart\\PaidWiFi\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\datamart\\paidwifi\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3f4 [0104.857] GetLastError () returned 0x0 [0104.857] GetFileType (hFile=0x3f4) returned 0x1 [0104.857] SetErrorMode (uMode=0x0) returned 0x1 [0104.857] GetFileType (hFile=0x3f4) returned 0x1 [0104.858] WriteFile (in: hFile=0x3f4, lpBuffer=0x2af83c8*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe968, lpOverlapped=0x0 | out: lpBuffer=0x2af83c8*, lpNumberOfBytesWritten=0x8fe968*=0xbcb, lpOverlapped=0x0) returned 1 [0104.858] GetLastError () returned 0x0 [0104.858] CloseHandle (hObject=0x3f4) returned 1 [0104.859] GetLastError () returned 0x0 [0104.859] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DataMart\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DataMart\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x38 [0104.859] GetLastError () returned 0x0 [0104.859] SetErrorMode (uMode=0x1) returned 0x0 [0104.859] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DataMart\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\datamart\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3f4 [0104.860] GetLastError () returned 0x0 [0104.860] GetFileType (hFile=0x3f4) returned 0x1 [0104.860] SetErrorMode (uMode=0x0) returned 0x1 [0104.860] GetFileType (hFile=0x3f4) returned 0x1 [0104.860] WriteFile (in: hFile=0x3f4, lpBuffer=0x2aff094*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe99c, lpOverlapped=0x0 | out: lpBuffer=0x2aff094*, lpNumberOfBytesWritten=0x8fe99c*=0xbcb, lpOverlapped=0x0) returned 1 [0104.861] GetLastError () returned 0x0 [0104.861] CloseHandle (hObject=0x3f4) returned 1 [0104.861] GetLastError () returned 0x0 [0104.861] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage", nBufferLength=0x105, lpBuffer=0x8fe508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage", lpFilePart=0x0) returned 0x29 [0104.861] GetLastError () returned 0x0 [0104.861] SetErrorMode (uMode=0x1) returned 0x0 [0104.861] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f62e0 [0104.861] GetLastError () returned 0x0 [0104.861] FindNextFileW (in: hFindFile=0x9f62e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.862] GetLastError () returned 0x0 [0104.862] FindNextFileW (in: hFindFile=0x9f62e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bd6f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device", cAlternateFileName="")) returned 1 [0104.862] GetLastError () returned 0x0 [0104.862] FindNextFileW (in: hFindFile=0x9f62e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 1 [0104.862] GetLastError () returned 0x0 [0104.862] FindNextFileW (in: hFindFile=0x9f62e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 0 [0104.862] GetLastError () returned 0x12 [0104.862] FindClose (in: hFindFile=0x9f62e0 | out: hFindFile=0x9f62e0) returned 1 [0104.862] SetErrorMode (uMode=0x0) returned 0x1 [0104.862] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage", nBufferLength=0x105, lpBuffer=0x8fe508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage", lpFilePart=0x0) returned 0x29 [0104.862] GetLastError () returned 0x12 [0104.862] SetErrorMode (uMode=0x1) returned 0x0 [0104.862] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f63a0 [0104.863] GetLastError () returned 0x12 [0104.863] FindNextFileW (in: hFindFile=0x9f63a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.863] GetLastError () returned 0x12 [0104.863] FindNextFileW (in: hFindFile=0x9f63a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bd6f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device", cAlternateFileName="")) returned 1 [0104.863] GetLastError () returned 0x12 [0104.863] FindNextFileW (in: hFindFile=0x9f63a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 1 [0104.863] GetLastError () returned 0x12 [0104.863] FindNextFileW (in: hFindFile=0x9f63a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 0 [0104.863] GetLastError () returned 0x12 [0104.863] FindClose (in: hFindFile=0x9f63a0 | out: hFindFile=0x9f63a0) returned 1 [0104.863] SetErrorMode (uMode=0x0) returned 0x1 [0104.863] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device", lpFilePart=0x0) returned 0x30 [0104.863] GetLastError () returned 0x12 [0104.863] SetErrorMode (uMode=0x1) returned 0x0 [0104.863] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bd6f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f65a0 [0104.864] GetLastError () returned 0x12 [0104.864] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bd6f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.864] GetLastError () returned 0x12 [0104.864] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd55373b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{113527a4-45d4-4b6f-b567-97838f1b04b0}", cAlternateFileName="{11352~1")) returned 1 [0104.864] GetLastError () returned 0x12 [0104.864] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 1 [0104.865] GetLastError () returned 0x12 [0104.865] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 0 [0104.865] GetLastError () returned 0x12 [0104.865] FindClose (in: hFindFile=0x9f65a0 | out: hFindFile=0x9f65a0) returned 1 [0104.865] SetErrorMode (uMode=0x0) returned 0x1 [0104.865] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device", lpFilePart=0x0) returned 0x30 [0104.865] GetLastError () returned 0x12 [0104.865] SetErrorMode (uMode=0x1) returned 0x0 [0104.865] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bd6f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f65a0 [0104.865] GetLastError () returned 0x12 [0104.865] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bd6f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.866] GetLastError () returned 0x12 [0104.866] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd55373b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{113527a4-45d4-4b6f-b567-97838f1b04b0}", cAlternateFileName="{11352~1")) returned 1 [0104.866] GetLastError () returned 0x12 [0104.866] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 1 [0104.866] GetLastError () returned 0x12 [0104.866] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 0 [0104.866] GetLastError () returned 0x12 [0104.866] FindClose (in: hFindFile=0x9f65a0 | out: hFindFile=0x9f65a0) returned 1 [0104.866] SetErrorMode (uMode=0x0) returned 0x1 [0104.866] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpFilePart=0x0) returned 0x57 [0104.866] GetLastError () returned 0x12 [0104.866] SetErrorMode (uMode=0x1) returned 0x0 [0104.866] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd55373b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6060 [0104.868] GetLastError () returned 0x12 [0104.868] FindNextFileW (in: hFindFile=0x9f6060, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd55373b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.868] GetLastError () returned 0x12 [0104.868] FindNextFileW (in: hFindFile=0x9f6060, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0104.868] GetLastError () returned 0x12 [0104.868] FindNextFileW (in: hFindFile=0x9f6060, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb61, dwReserved0=0x0, dwReserved1=0x0, cFileName="behavior.xml", cAlternateFileName="")) returned 1 [0104.868] GetLastError () returned 0x12 [0104.868] FindNextFileW (in: hFindFile=0x9f6060, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="device.png", cAlternateFileName="")) returned 1 [0104.868] GetLastError () returned 0x12 [0104.868] FindNextFileW (in: hFindFile=0x9f6060, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="overlay.png", cAlternateFileName="")) returned 1 [0104.868] GetLastError () returned 0x12 [0104.868] FindNextFileW (in: hFindFile=0x9f6060, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="superbar.png", cAlternateFileName="")) returned 1 [0104.868] GetLastError () returned 0x12 [0104.868] FindNextFileW (in: hFindFile=0x9f6060, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="superbar.png", cAlternateFileName="")) returned 0 [0104.868] GetLastError () returned 0x12 [0104.868] FindClose (in: hFindFile=0x9f6060 | out: hFindFile=0x9f6060) returned 1 [0104.869] SetErrorMode (uMode=0x0) returned 0x1 [0104.869] GetProcessWindowStation () returned 0x13c [0104.869] GetActiveWindow () returned 0x7002e [0104.869] GetCurrentActCtx (in: lphActCtx=0x8fe8f0 | out: lphActCtx=0x8fe8f0*=0x9f8cbc) returned 1 [0104.869] GetCurrentThreadId () returned 0x540 [0104.870] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4c5a, lParam=0x0) returned 1 [0104.870] IsWindowVisible (hWnd=0x7002e) returned 0 [0104.870] IsWindowVisible (hWnd=0x4020e) returned 0 [0104.870] IsWindowVisible (hWnd=0x60044) returned 0 [0104.870] IsWindowVisible (hWnd=0x2021a) returned 0 [0104.870] IsWindowVisible (hWnd=0x8004a) returned 0 [0104.870] GetActiveWindow () returned 0x7002e [0104.870] GetFocus () returned 0x7002e [0104.870] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0104.871] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0104.871] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0104.872] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0104.872] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0104.872] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0104.873] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0104.879] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x79020c) returned 0x1 [0104.880] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0104.880] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0105.026] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0105.033] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0105.033] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0105.033] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x79020c) returned 0x1 [0105.034] SetFocus (hWnd=0x7002e) returned 0x79020c [0105.036] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0105.037] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0105.038] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0105.038] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0105.038] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x79020c, lParam=0x0) returned 0x0 [0105.042] IsWindow (hWnd=0x7002e) returned 1 [0105.042] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0105.042] IsWindow (hWnd=0x7002e) returned 1 [0105.042] SetFocus (hWnd=0x7002e) returned 0x7002e [0105.042] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0105.042] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0105.042] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0105.043] GetProcessWindowStation () returned 0x13c [0105.043] GetActiveWindow () returned 0x7002e [0105.043] GetCurrentActCtx (in: lphActCtx=0x8fe8f0 | out: lphActCtx=0x8fe8f0*=0x9f8cbc) returned 1 [0105.043] GetCurrentThreadId () returned 0x540 [0105.043] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4f5a, lParam=0x0) returned 1 [0105.043] IsWindowVisible (hWnd=0x7002e) returned 0 [0105.043] IsWindowVisible (hWnd=0x4020e) returned 0 [0105.043] IsWindowVisible (hWnd=0x60044) returned 0 [0105.043] IsWindowVisible (hWnd=0x2021a) returned 0 [0105.043] IsWindowVisible (hWnd=0x8004a) returned 0 [0105.043] GetActiveWindow () returned 0x7002e [0105.043] GetFocus () returned 0x7002e [0105.043] MessageBoxW (hWnd=0x7002e, lpText="NXyNoRQO0TFdIlV2YRevXQ==", lpCaption="", uType=0x0) returned 1 [0105.044] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0105.045] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0105.045] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0105.046] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0105.046] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0105.046] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0105.054] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x7a020c) returned 0x1 [0105.055] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0105.055] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0105.390] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0105.397] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0105.397] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0105.397] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x7a020c) returned 0x1 [0105.398] SetFocus (hWnd=0x7002e) returned 0x7a020c [0105.400] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0105.401] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0105.401] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0105.402] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0105.402] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x7a020c, lParam=0x0) returned 0x0 [0105.406] IsWindow (hWnd=0x7002e) returned 1 [0105.406] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0105.406] IsWindow (hWnd=0x7002e) returned 1 [0105.406] SetFocus (hWnd=0x7002e) returned 0x7002e [0105.406] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0105.406] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0105.406] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0105.406] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", nBufferLength=0x105, lpBuffer=0x8fe4ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", lpFilePart=0x0) returned 0x66 [0105.406] GetLastError () returned 0x0 [0105.406] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", dwFileAttributes=0x80) returned 0 [0105.409] GetLastError () returned 0x5 [0105.415] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", nBufferLength=0x105, lpBuffer=0x8fe3bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", lpFilePart=0x0) returned 0x66 [0105.415] GetLastError () returned 0x5 [0105.415] SetErrorMode (uMode=0x1) returned 0x0 [0105.415] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0105.416] GetLastError () returned 0x0 [0105.416] GetFileType (hFile=0x3f4) returned 0x1 [0105.416] SetErrorMode (uMode=0x0) returned 0x1 [0105.416] GetFileType (hFile=0x3f4) returned 0x1 [0105.416] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x8fe970 | out: lpFileSizeHigh=0x8fe970*=0x0) returned 0x1fad1 [0105.416] GetLastError () returned 0x0 [0105.417] ReadFile (in: hFile=0x3f4, lpBuffer=0x3a42730, nNumberOfBytesToRead=0x1fad1, lpNumberOfBytesRead=0x8fe918, lpOverlapped=0x0 | out: lpBuffer=0x3a42730*, lpNumberOfBytesRead=0x8fe918*=0x1fad1, lpOverlapped=0x0) returned 1 [0105.422] GetLastError () returned 0x0 [0105.422] CloseHandle (hObject=0x3f4) returned 1 [0105.422] GetLastError () returned 0x0 [0105.422] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0105.422] GetLastError () returned 0x0 [0105.422] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8c0 | out: phKey=0x8fe8c0*=0x9f6060) returned 1 [0105.422] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0105.422] GetLastError () returned 0x0 [0105.422] CryptSetKeyParam (hKey=0x9f6060, dwParam=0x4, pbData=0x2b044f8*=0x1, dwFlags=0x0) returned 1 [0105.422] GetLastError () returned 0x0 [0105.422] CryptSetKeyParam (hKey=0x9f6060, dwParam=0x1, pbData=0x2b044c4, dwFlags=0x0) returned 1 [0105.422] GetLastError () returned 0x0 [0105.425] CryptEncrypt (in: hKey=0x9f6060, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a62220*, pdwDataLen=0x8fe978*=0x1fae0, dwBufLen=0x1fae0 | out: pbData=0x3a62220*, pdwDataLen=0x8fe978*=0x1fae0) returned 1 [0105.425] GetLastError () returned 0x0 [0105.425] CryptEncrypt (in: hKey=0x9f6060, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b0451c*, pdwDataLen=0x8fe980*=0x0, dwBufLen=0x10 | out: pbData=0x2b0451c*, pdwDataLen=0x8fe980*=0x10) returned 1 [0105.425] GetLastError () returned 0x0 [0105.425] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", nBufferLength=0x105, lpBuffer=0x8fe3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", lpFilePart=0x0) returned 0x66 [0105.425] GetLastError () returned 0x0 [0105.425] SetErrorMode (uMode=0x1) returned 0x0 [0105.425] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0105.425] GetLastError () returned 0x5 [0105.429] SetErrorMode (uMode=0x0) returned 0x1 [0105.430] GetProcessWindowStation () returned 0x13c [0105.430] GetActiveWindow () returned 0x7002e [0105.430] GetCurrentActCtx (in: lphActCtx=0x8fe8f0 | out: lphActCtx=0x8fe8f0*=0x9f8cbc) returned 1 [0105.430] GetCurrentThreadId () returned 0x540 [0105.430] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4d4a, lParam=0x0) returned 1 [0105.430] IsWindowVisible (hWnd=0x7002e) returned 0 [0105.431] IsWindowVisible (hWnd=0x4020e) returned 0 [0105.431] IsWindowVisible (hWnd=0x60044) returned 0 [0105.431] IsWindowVisible (hWnd=0x2021a) returned 0 [0105.431] IsWindowVisible (hWnd=0x8004a) returned 0 [0105.431] GetActiveWindow () returned 0x7002e [0105.431] GetFocus () returned 0x7002e [0105.431] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0105.432] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0105.432] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0105.433] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0105.433] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0105.433] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0105.434] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0105.440] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x7b020c) returned 0x1 [0105.441] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0105.441] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0105.541] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0105.549] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0105.549] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0105.549] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x7b020c) returned 0x1 [0105.550] SetFocus (hWnd=0x7002e) returned 0x7b020c [0105.552] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0105.553] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0105.554] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0105.554] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0105.554] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x7b020c, lParam=0x0) returned 0x0 [0105.558] IsWindow (hWnd=0x7002e) returned 1 [0105.558] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0105.558] IsWindow (hWnd=0x7002e) returned 1 [0105.559] SetFocus (hWnd=0x7002e) returned 0x7002e [0105.559] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0105.559] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0105.559] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0105.559] GetProcessWindowStation () returned 0x13c [0105.559] GetActiveWindow () returned 0x7002e [0105.559] GetCurrentActCtx (in: lphActCtx=0x8fe8f0 | out: lphActCtx=0x8fe8f0*=0x9f8cbc) returned 1 [0105.559] GetCurrentThreadId () returned 0x540 [0105.559] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4fba, lParam=0x0) returned 1 [0105.560] IsWindowVisible (hWnd=0x7002e) returned 0 [0105.560] IsWindowVisible (hWnd=0x4020e) returned 0 [0105.560] IsWindowVisible (hWnd=0x60044) returned 0 [0105.560] IsWindowVisible (hWnd=0x2021a) returned 0 [0105.560] IsWindowVisible (hWnd=0x8004a) returned 0 [0105.560] GetActiveWindow () returned 0x7002e [0105.560] GetFocus () returned 0x7002e [0105.560] MessageBoxW (hWnd=0x7002e, lpText="GuUmkLVfx+Xz6S+jYrCPOQ==", lpCaption="", uType=0x0) returned 1 [0105.561] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0105.561] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0105.562] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0105.562] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0105.562] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0105.563] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0105.571] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x7c020c) returned 0x1 [0105.572] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0105.572] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0105.746] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0105.753] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0105.753] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0105.753] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x7c020c) returned 0x1 [0105.755] SetFocus (hWnd=0x7002e) returned 0x7c020c [0105.757] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0105.758] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0105.758] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0105.759] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0105.759] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x7c020c, lParam=0x0) returned 0x0 [0105.763] IsWindow (hWnd=0x7002e) returned 1 [0105.763] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0105.763] IsWindow (hWnd=0x7002e) returned 1 [0105.763] SetFocus (hWnd=0x7002e) returned 0x7002e [0105.763] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0105.763] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0105.763] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0105.763] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml", nBufferLength=0x105, lpBuffer=0x8fe4ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml", lpFilePart=0x0) returned 0x64 [0105.764] GetLastError () returned 0x0 [0105.764] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml", dwFileAttributes=0x80) returned 0 [0105.764] GetLastError () returned 0x5 [0105.766] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml", nBufferLength=0x105, lpBuffer=0x8fe3bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml", lpFilePart=0x0) returned 0x64 [0105.766] GetLastError () returned 0x5 [0105.766] SetErrorMode (uMode=0x1) returned 0x0 [0105.766] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0105.766] GetLastError () returned 0x0 [0105.766] GetFileType (hFile=0x3f4) returned 0x1 [0105.766] SetErrorMode (uMode=0x0) returned 0x1 [0105.766] GetFileType (hFile=0x3f4) returned 0x1 [0105.766] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x8fe970 | out: lpFileSizeHigh=0x8fe970*=0x0) returned 0xb61 [0105.766] GetLastError () returned 0x0 [0105.766] ReadFile (in: hFile=0x3f4, lpBuffer=0x2b0bb34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe918, lpOverlapped=0x0 | out: lpBuffer=0x2b0bb34*, lpNumberOfBytesRead=0x8fe918*=0xb61, lpOverlapped=0x0) returned 1 [0105.770] GetLastError () returned 0x0 [0105.770] CloseHandle (hObject=0x3f4) returned 1 [0105.770] GetLastError () returned 0x0 [0105.770] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0105.770] GetLastError () returned 0x0 [0105.770] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8c0 | out: phKey=0x8fe8c0*=0x9f65a0) returned 1 [0105.770] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0105.770] GetLastError () returned 0x0 [0105.770] CryptSetKeyParam (hKey=0x9f65a0, dwParam=0x4, pbData=0x2b0cba8*=0x1, dwFlags=0x0) returned 1 [0105.770] GetLastError () returned 0x0 [0105.770] CryptSetKeyParam (hKey=0x9f65a0, dwParam=0x1, pbData=0x2b0cb74, dwFlags=0x0) returned 1 [0105.770] GetLastError () returned 0x0 [0105.770] CryptEncrypt (in: hKey=0x9f65a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b0cbb8*, pdwDataLen=0x8fe978*=0xb70, dwBufLen=0xb70 | out: pbData=0x2b0cbb8*, pdwDataLen=0x8fe978*=0xb70) returned 1 [0105.770] GetLastError () returned 0x0 [0105.771] CryptEncrypt (in: hKey=0x9f65a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b0d748*, pdwDataLen=0x8fe980*=0x0, dwBufLen=0x10 | out: pbData=0x2b0d748*, pdwDataLen=0x8fe980*=0x10) returned 1 [0105.771] GetLastError () returned 0x0 [0105.771] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml", nBufferLength=0x105, lpBuffer=0x8fe3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml", lpFilePart=0x0) returned 0x64 [0105.771] GetLastError () returned 0x0 [0105.771] SetErrorMode (uMode=0x1) returned 0x0 [0105.771] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0105.774] GetLastError () returned 0x5 [0105.776] SetErrorMode (uMode=0x0) returned 0x1 [0105.783] GetProcessWindowStation () returned 0x13c [0105.783] GetActiveWindow () returned 0x7002e [0105.783] GetCurrentActCtx (in: lphActCtx=0x8fe8f0 | out: lphActCtx=0x8fe8f0*=0x9f8cbc) returned 1 [0105.783] GetCurrentThreadId () returned 0x540 [0105.783] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4b6a, lParam=0x0) returned 1 [0105.783] IsWindowVisible (hWnd=0x7002e) returned 0 [0105.783] IsWindowVisible (hWnd=0x4020e) returned 0 [0105.784] IsWindowVisible (hWnd=0x60044) returned 0 [0105.784] IsWindowVisible (hWnd=0x2021a) returned 0 [0105.784] IsWindowVisible (hWnd=0x8004a) returned 0 [0105.784] GetActiveWindow () returned 0x7002e [0105.784] GetFocus () returned 0x7002e [0105.784] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0105.785] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0105.785] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0105.786] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0105.786] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0105.786] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0105.787] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0105.793] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x7d020c) returned 0x1 [0105.794] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0105.794] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0106.133] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0106.145] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0106.145] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0106.145] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x7d020c) returned 0x1 [0106.150] SetFocus (hWnd=0x7002e) returned 0x7d020c [0106.152] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0106.153] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0106.153] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0106.154] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0106.154] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x7d020c, lParam=0x0) returned 0x0 [0106.158] IsWindow (hWnd=0x7002e) returned 1 [0106.158] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0106.158] IsWindow (hWnd=0x7002e) returned 1 [0106.158] SetFocus (hWnd=0x7002e) returned 0x7002e [0106.158] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0106.158] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0106.158] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0106.159] GetProcessWindowStation () returned 0x13c [0106.159] GetActiveWindow () returned 0x7002e [0106.159] GetCurrentActCtx (in: lphActCtx=0x8fe8f0 | out: lphActCtx=0x8fe8f0*=0x9f8cbc) returned 1 [0106.159] GetCurrentThreadId () returned 0x540 [0106.159] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4bca, lParam=0x0) returned 1 [0106.159] IsWindowVisible (hWnd=0x7002e) returned 0 [0106.159] IsWindowVisible (hWnd=0x4020e) returned 0 [0106.159] IsWindowVisible (hWnd=0x60044) returned 0 [0106.159] IsWindowVisible (hWnd=0x2021a) returned 0 [0106.160] IsWindowVisible (hWnd=0x8004a) returned 0 [0106.160] GetActiveWindow () returned 0x7002e [0106.160] GetFocus () returned 0x7002e [0106.160] MessageBoxW (hWnd=0x7002e, lpText="ulxIcvusDk6hQqnlcot6Qw==", lpCaption="", uType=0x0) returned 1 [0106.161] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0106.161] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0106.164] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0106.165] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0106.165] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0106.165] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0106.171] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x7e020c) returned 0x1 [0106.172] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0106.172] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0106.280] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0106.289] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0106.289] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0106.289] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x7e020c) returned 0x1 [0106.291] SetFocus (hWnd=0x7002e) returned 0x7e020c [0106.292] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0106.294] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0106.294] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0106.294] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0106.294] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x7e020c, lParam=0x0) returned 0x0 [0106.298] IsWindow (hWnd=0x7002e) returned 1 [0106.298] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0106.298] IsWindow (hWnd=0x7002e) returned 1 [0106.298] SetFocus (hWnd=0x7002e) returned 0x7002e [0106.298] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0106.298] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0106.298] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0106.298] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", nBufferLength=0x105, lpBuffer=0x8fe4ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", lpFilePart=0x0) returned 0x62 [0106.298] GetLastError () returned 0x0 [0106.299] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", dwFileAttributes=0x80) returned 0 [0106.300] GetLastError () returned 0x5 [0106.302] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", nBufferLength=0x105, lpBuffer=0x8fe3bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", lpFilePart=0x0) returned 0x62 [0106.302] GetLastError () returned 0x5 [0106.302] SetErrorMode (uMode=0x1) returned 0x0 [0106.304] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0106.305] GetLastError () returned 0x0 [0106.305] GetFileType (hFile=0x3f4) returned 0x1 [0106.305] SetErrorMode (uMode=0x0) returned 0x1 [0106.305] GetFileType (hFile=0x3f4) returned 0x1 [0106.305] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x8fe970 | out: lpFileSizeHigh=0x8fe970*=0x0) returned 0xadc8 [0106.305] GetLastError () returned 0x0 [0106.305] ReadFile (in: hFile=0x3f4, lpBuffer=0x2b12668, nNumberOfBytesToRead=0xadc8, lpNumberOfBytesRead=0x8fe918, lpOverlapped=0x0 | out: lpBuffer=0x2b12668*, lpNumberOfBytesRead=0x8fe918*=0xadc8, lpOverlapped=0x0) returned 1 [0106.307] GetLastError () returned 0x0 [0106.307] CloseHandle (hObject=0x3f4) returned 1 [0106.307] GetLastError () returned 0x0 [0106.307] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0106.307] GetLastError () returned 0x0 [0106.307] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8c0 | out: phKey=0x8fe8c0*=0x9f6620) returned 1 [0106.307] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0106.307] GetLastError () returned 0x0 [0106.307] CryptSetKeyParam (hKey=0x9f6620, dwParam=0x4, pbData=0x2b1d4a4*=0x1, dwFlags=0x0) returned 1 [0106.307] GetLastError () returned 0x0 [0106.307] CryptSetKeyParam (hKey=0x9f6620, dwParam=0x1, pbData=0x2b1d470, dwFlags=0x0) returned 1 [0106.307] GetLastError () returned 0x0 [0106.307] CryptEncrypt (in: hKey=0x9f6620, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b1d4b4*, pdwDataLen=0x8fe978*=0xadd0, dwBufLen=0xadd0 | out: pbData=0x2b1d4b4*, pdwDataLen=0x8fe978*=0xadd0) returned 1 [0106.308] GetLastError () returned 0x0 [0106.308] CryptEncrypt (in: hKey=0x9f6620, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b282a4*, pdwDataLen=0x8fe980*=0x0, dwBufLen=0x10 | out: pbData=0x2b282a4*, pdwDataLen=0x8fe980*=0x10) returned 1 [0106.308] GetLastError () returned 0x0 [0106.308] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", nBufferLength=0x105, lpBuffer=0x8fe3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", lpFilePart=0x0) returned 0x62 [0106.308] GetLastError () returned 0x0 [0106.308] SetErrorMode (uMode=0x1) returned 0x0 [0106.308] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0106.308] GetLastError () returned 0x5 [0106.310] SetErrorMode (uMode=0x0) returned 0x1 [0106.310] GetProcessWindowStation () returned 0x13c [0106.310] GetActiveWindow () returned 0x7002e [0106.310] GetCurrentActCtx (in: lphActCtx=0x8fe8f0 | out: lphActCtx=0x8fe8f0*=0x9f8cbc) returned 1 [0106.310] GetCurrentThreadId () returned 0x540 [0106.311] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4f8a, lParam=0x0) returned 1 [0106.311] IsWindowVisible (hWnd=0x7002e) returned 0 [0106.311] IsWindowVisible (hWnd=0x4020e) returned 0 [0106.311] IsWindowVisible (hWnd=0x60044) returned 0 [0106.311] IsWindowVisible (hWnd=0x2021a) returned 0 [0106.311] IsWindowVisible (hWnd=0x8004a) returned 0 [0106.311] GetActiveWindow () returned 0x7002e [0106.311] GetFocus () returned 0x7002e [0106.311] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0106.312] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0106.313] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0106.313] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0106.314] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0106.314] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0106.314] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0106.371] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x7f020c) returned 0x1 [0106.372] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0106.372] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0106.481] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0106.489] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0106.489] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0106.489] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x7f020c) returned 0x1 [0106.493] SetFocus (hWnd=0x7002e) returned 0x7f020c [0106.494] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0106.496] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0106.496] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0106.496] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0106.496] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x7f020c, lParam=0x0) returned 0x0 [0106.501] IsWindow (hWnd=0x7002e) returned 1 [0106.501] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0106.501] IsWindow (hWnd=0x7002e) returned 1 [0106.501] SetFocus (hWnd=0x7002e) returned 0x7002e [0106.501] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0106.501] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0106.501] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0106.501] GetProcessWindowStation () returned 0x13c [0106.501] GetActiveWindow () returned 0x7002e [0106.501] GetCurrentActCtx (in: lphActCtx=0x8fe8f0 | out: lphActCtx=0x8fe8f0*=0x9f8cbc) returned 1 [0106.501] GetCurrentThreadId () returned 0x540 [0106.502] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4eca, lParam=0x0) returned 1 [0106.502] IsWindowVisible (hWnd=0x7002e) returned 0 [0106.502] IsWindowVisible (hWnd=0x4020e) returned 0 [0106.502] IsWindowVisible (hWnd=0x60044) returned 0 [0106.502] IsWindowVisible (hWnd=0x2021a) returned 0 [0106.502] IsWindowVisible (hWnd=0x8004a) returned 0 [0106.502] GetActiveWindow () returned 0x7002e [0106.502] GetFocus () returned 0x7002e [0106.502] MessageBoxW (hWnd=0x7002e, lpText="NGAdePFy0M1DD9zgsWqnFw==", lpCaption="", uType=0x0) returned 1 [0106.503] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0106.504] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0106.504] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0106.505] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0106.505] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0106.505] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0106.516] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x80020c) returned 0x1 [0106.517] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0106.517] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0106.678] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0106.685] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0106.685] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0106.685] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x80020c) returned 0x1 [0106.686] SetFocus (hWnd=0x7002e) returned 0x80020c [0106.688] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0106.689] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0106.689] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0106.690] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0106.690] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x80020c, lParam=0x0) returned 0x0 [0106.697] IsWindow (hWnd=0x7002e) returned 1 [0106.697] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0106.697] IsWindow (hWnd=0x7002e) returned 1 [0106.697] SetFocus (hWnd=0x7002e) returned 0x7002e [0106.697] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0106.697] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0106.697] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0106.697] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", nBufferLength=0x105, lpBuffer=0x8fe4ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", lpFilePart=0x0) returned 0x63 [0106.697] GetLastError () returned 0x0 [0106.697] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", dwFileAttributes=0x80) returned 0 [0106.700] GetLastError () returned 0x5 [0106.702] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", nBufferLength=0x105, lpBuffer=0x8fe3bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", lpFilePart=0x0) returned 0x63 [0106.702] GetLastError () returned 0x5 [0106.702] SetErrorMode (uMode=0x1) returned 0x0 [0106.702] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0106.703] GetLastError () returned 0x0 [0106.703] GetFileType (hFile=0x3f4) returned 0x1 [0106.703] SetErrorMode (uMode=0x0) returned 0x1 [0106.703] GetFileType (hFile=0x3f4) returned 0x1 [0106.703] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x8fe970 | out: lpFileSizeHigh=0x8fe970*=0x0) returned 0x70c1 [0106.703] GetLastError () returned 0x0 [0106.703] ReadFile (in: hFile=0x3f4, lpBuffer=0x2b2df5c, nNumberOfBytesToRead=0x70c1, lpNumberOfBytesRead=0x8fe918, lpOverlapped=0x0 | out: lpBuffer=0x2b2df5c*, lpNumberOfBytesRead=0x8fe918*=0x70c1, lpOverlapped=0x0) returned 1 [0106.705] GetLastError () returned 0x0 [0106.705] CloseHandle (hObject=0x3f4) returned 1 [0106.705] GetLastError () returned 0x0 [0106.705] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0106.705] GetLastError () returned 0x0 [0106.705] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8c0 | out: phKey=0x8fe8c0*=0x9f60a0) returned 1 [0106.705] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0106.705] GetLastError () returned 0x0 [0106.705] CryptSetKeyParam (hKey=0x9f60a0, dwParam=0x4, pbData=0x2b35094*=0x1, dwFlags=0x0) returned 1 [0106.705] GetLastError () returned 0x0 [0106.705] CryptSetKeyParam (hKey=0x9f60a0, dwParam=0x1, pbData=0x2b35060, dwFlags=0x0) returned 1 [0106.705] GetLastError () returned 0x0 [0106.706] CryptEncrypt (in: hKey=0x9f60a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b350a4*, pdwDataLen=0x8fe978*=0x70d0, dwBufLen=0x70d0 | out: pbData=0x2b350a4*, pdwDataLen=0x8fe978*=0x70d0) returned 1 [0106.706] GetLastError () returned 0x0 [0106.706] CryptEncrypt (in: hKey=0x9f60a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b3c194*, pdwDataLen=0x8fe980*=0x0, dwBufLen=0x10 | out: pbData=0x2b3c194*, pdwDataLen=0x8fe980*=0x10) returned 1 [0106.706] GetLastError () returned 0x0 [0106.706] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", nBufferLength=0x105, lpBuffer=0x8fe3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", lpFilePart=0x0) returned 0x63 [0106.706] GetLastError () returned 0x0 [0106.706] SetErrorMode (uMode=0x1) returned 0x0 [0106.706] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0106.706] GetLastError () returned 0x5 [0106.708] SetErrorMode (uMode=0x0) returned 0x1 [0106.709] GetProcessWindowStation () returned 0x13c [0106.723] GetActiveWindow () returned 0x7002e [0106.724] GetCurrentActCtx (in: lphActCtx=0x8fe8f0 | out: lphActCtx=0x8fe8f0*=0x9f8cbc) returned 1 [0106.724] GetCurrentThreadId () returned 0x540 [0106.724] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4c8a, lParam=0x0) returned 1 [0106.724] IsWindowVisible (hWnd=0x7002e) returned 0 [0106.724] IsWindowVisible (hWnd=0x4020e) returned 0 [0106.724] IsWindowVisible (hWnd=0x60044) returned 0 [0106.724] IsWindowVisible (hWnd=0x2021a) returned 0 [0106.724] IsWindowVisible (hWnd=0x8004a) returned 0 [0106.725] GetActiveWindow () returned 0x7002e [0106.725] GetFocus () returned 0x7002e [0106.725] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0106.726] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0106.727] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0106.727] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0106.728] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0106.728] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0106.728] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0106.734] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x81020c) returned 0x1 [0106.735] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0106.735] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0106.888] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0106.907] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0106.907] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0106.907] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x81020c) returned 0x1 [0106.908] SetFocus (hWnd=0x7002e) returned 0x81020c [0106.910] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0106.911] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0106.911] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0106.912] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0106.912] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x81020c, lParam=0x0) returned 0x0 [0106.917] IsWindow (hWnd=0x7002e) returned 1 [0106.917] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0106.917] IsWindow (hWnd=0x7002e) returned 1 [0106.918] SetFocus (hWnd=0x7002e) returned 0x7002e [0106.918] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0106.918] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0106.918] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0106.918] GetProcessWindowStation () returned 0x13c [0106.918] GetActiveWindow () returned 0x7002e [0106.918] GetCurrentActCtx (in: lphActCtx=0x8fe8f0 | out: lphActCtx=0x8fe8f0*=0x9f8cbc) returned 1 [0106.918] GetCurrentThreadId () returned 0x540 [0106.918] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4c2a, lParam=0x0) returned 1 [0106.919] IsWindowVisible (hWnd=0x7002e) returned 0 [0106.919] IsWindowVisible (hWnd=0x4020e) returned 0 [0106.919] IsWindowVisible (hWnd=0x60044) returned 0 [0106.919] IsWindowVisible (hWnd=0x2021a) returned 0 [0106.919] IsWindowVisible (hWnd=0x8004a) returned 0 [0106.919] GetActiveWindow () returned 0x7002e [0106.919] GetFocus () returned 0x7002e [0106.919] MessageBoxW (hWnd=0x7002e, lpText="RfrXKExi9lAUbkITH8bytA==", lpCaption="", uType=0x0) returned 1 [0106.920] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0106.920] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0106.921] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0106.921] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0106.921] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0106.922] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0106.928] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x82020c) returned 0x1 [0106.931] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0106.931] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0107.097] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0107.107] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0107.107] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0107.107] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x82020c) returned 0x1 [0107.109] SetFocus (hWnd=0x7002e) returned 0x82020c [0107.110] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0107.112] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0107.112] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0107.112] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0107.112] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x82020c, lParam=0x0) returned 0x0 [0107.116] IsWindow (hWnd=0x7002e) returned 1 [0107.116] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0107.116] IsWindow (hWnd=0x7002e) returned 1 [0107.116] SetFocus (hWnd=0x7002e) returned 0x7002e [0107.116] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0107.117] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0107.117] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0107.117] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", nBufferLength=0x105, lpBuffer=0x8fe4ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", lpFilePart=0x0) returned 0x64 [0107.117] GetLastError () returned 0x0 [0107.117] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", dwFileAttributes=0x80) returned 0 [0107.120] GetLastError () returned 0x5 [0107.122] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", nBufferLength=0x105, lpBuffer=0x8fe3bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", lpFilePart=0x0) returned 0x64 [0107.122] GetLastError () returned 0x5 [0107.122] SetErrorMode (uMode=0x1) returned 0x0 [0107.122] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0107.122] GetLastError () returned 0x0 [0107.122] GetFileType (hFile=0x3f4) returned 0x1 [0107.122] SetErrorMode (uMode=0x0) returned 0x1 [0107.122] GetFileType (hFile=0x3f4) returned 0x1 [0107.122] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x8fe970 | out: lpFileSizeHigh=0x8fe970*=0x0) returned 0x99d3 [0107.122] GetLastError () returned 0x0 [0107.122] ReadFile (in: hFile=0x3f4, lpBuffer=0x2b41e64, nNumberOfBytesToRead=0x99d3, lpNumberOfBytesRead=0x8fe918, lpOverlapped=0x0 | out: lpBuffer=0x2b41e64*, lpNumberOfBytesRead=0x8fe918*=0x99d3, lpOverlapped=0x0) returned 1 [0107.124] GetLastError () returned 0x0 [0107.124] CloseHandle (hObject=0x3f4) returned 1 [0107.124] GetLastError () returned 0x0 [0107.124] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0107.124] GetLastError () returned 0x0 [0107.124] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8c0 | out: phKey=0x8fe8c0*=0x9f6660) returned 1 [0107.124] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0107.125] GetLastError () returned 0x0 [0107.125] CryptSetKeyParam (hKey=0x9f6660, dwParam=0x4, pbData=0x2b4b8ac*=0x1, dwFlags=0x0) returned 1 [0107.125] GetLastError () returned 0x0 [0107.125] CryptSetKeyParam (hKey=0x9f6660, dwParam=0x1, pbData=0x2b4b878, dwFlags=0x0) returned 1 [0107.125] GetLastError () returned 0x0 [0107.125] CryptEncrypt (in: hKey=0x9f6660, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b4b8bc*, pdwDataLen=0x8fe978*=0x99e0, dwBufLen=0x99e0 | out: pbData=0x2b4b8bc*, pdwDataLen=0x8fe978*=0x99e0) returned 1 [0107.125] GetLastError () returned 0x0 [0107.125] CryptEncrypt (in: hKey=0x9f6660, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b552bc*, pdwDataLen=0x8fe980*=0x0, dwBufLen=0x10 | out: pbData=0x2b552bc*, pdwDataLen=0x8fe980*=0x10) returned 1 [0107.125] GetLastError () returned 0x0 [0107.125] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", nBufferLength=0x105, lpBuffer=0x8fe3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", lpFilePart=0x0) returned 0x64 [0107.125] GetLastError () returned 0x0 [0107.125] SetErrorMode (uMode=0x1) returned 0x0 [0107.125] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0107.126] GetLastError () returned 0x5 [0107.127] SetErrorMode (uMode=0x0) returned 0x1 [0107.137] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpFilePart=0x0) returned 0x57 [0107.137] GetLastError () returned 0x5 [0107.137] SetErrorMode (uMode=0x1) returned 0x0 [0107.137] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd55373b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f66a0 [0107.137] GetLastError () returned 0x5 [0107.138] FindNextFileW (in: hFindFile=0x9f66a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd55373b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.138] GetLastError () returned 0x5 [0107.138] FindNextFileW (in: hFindFile=0x9f66a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0107.138] GetLastError () returned 0x5 [0107.138] FindNextFileW (in: hFindFile=0x9f66a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb61, dwReserved0=0x0, dwReserved1=0x0, cFileName="behavior.xml", cAlternateFileName="")) returned 1 [0107.138] GetLastError () returned 0x5 [0107.138] FindNextFileW (in: hFindFile=0x9f66a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="device.png", cAlternateFileName="")) returned 1 [0107.138] GetLastError () returned 0x5 [0107.138] FindNextFileW (in: hFindFile=0x9f66a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="overlay.png", cAlternateFileName="")) returned 1 [0107.138] GetLastError () returned 0x5 [0107.139] FindNextFileW (in: hFindFile=0x9f66a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="superbar.png", cAlternateFileName="")) returned 1 [0107.139] GetLastError () returned 0x5 [0107.139] FindNextFileW (in: hFindFile=0x9f66a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="superbar.png", cAlternateFileName="")) returned 0 [0107.139] GetLastError () returned 0x12 [0107.139] FindClose (in: hFindFile=0x9f66a0 | out: hFindFile=0x9f66a0) returned 1 [0107.139] SetErrorMode (uMode=0x0) returned 0x1 [0107.140] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe3dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x6a [0107.140] GetLastError () returned 0x12 [0107.140] SetErrorMode (uMode=0x1) returned 0x0 [0107.140] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3f4 [0107.140] GetLastError () returned 0x0 [0107.140] GetFileType (hFile=0x3f4) returned 0x1 [0107.140] SetErrorMode (uMode=0x0) returned 0x1 [0107.140] GetFileType (hFile=0x3f4) returned 0x1 [0107.140] WriteFile (in: hFile=0x3f4, lpBuffer=0x2b6011c*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe934, lpOverlapped=0x0 | out: lpBuffer=0x2b6011c*, lpNumberOfBytesWritten=0x8fe934*=0xbcb, lpOverlapped=0x0) returned 1 [0107.141] GetLastError () returned 0x0 [0107.141] CloseHandle (hObject=0x3f4) returned 1 [0107.141] GetLastError () returned 0x0 [0107.141] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", lpFilePart=0x0) returned 0x57 [0107.141] GetLastError () returned 0x0 [0107.142] SetErrorMode (uMode=0x1) returned 0x0 [0107.142] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f62e0 [0107.142] GetLastError () returned 0x0 [0107.142] FindNextFileW (in: hFindFile=0x9f62e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.142] GetLastError () returned 0x0 [0107.142] FindNextFileW (in: hFindFile=0x9f62e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0107.142] GetLastError () returned 0x0 [0107.142] FindNextFileW (in: hFindFile=0x9f62e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="behavior.xml", cAlternateFileName="")) returned 1 [0107.142] GetLastError () returned 0x0 [0107.143] FindNextFileW (in: hFindFile=0x9f62e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.png", cAlternateFileName="")) returned 1 [0107.143] GetLastError () returned 0x0 [0107.143] FindNextFileW (in: hFindFile=0x9f62e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.png", cAlternateFileName="")) returned 0 [0107.143] GetLastError () returned 0x12 [0107.143] FindClose (in: hFindFile=0x9f62e0 | out: hFindFile=0x9f62e0) returned 1 [0107.143] SetErrorMode (uMode=0x0) returned 0x1 [0107.143] GetProcessWindowStation () returned 0x13c [0107.143] GetActiveWindow () returned 0x7002e [0107.143] GetCurrentActCtx (in: lphActCtx=0x8fe8f0 | out: lphActCtx=0x8fe8f0*=0x9f8cbc) returned 1 [0107.143] GetCurrentThreadId () returned 0x540 [0107.144] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4daa, lParam=0x0) returned 1 [0107.144] IsWindowVisible (hWnd=0x7002e) returned 0 [0107.144] IsWindowVisible (hWnd=0x4020e) returned 0 [0107.144] IsWindowVisible (hWnd=0x60044) returned 0 [0107.144] IsWindowVisible (hWnd=0x2021a) returned 0 [0107.144] IsWindowVisible (hWnd=0x8004a) returned 0 [0107.144] GetActiveWindow () returned 0x7002e [0107.144] GetFocus () returned 0x7002e [0107.144] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0107.145] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0107.146] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0107.146] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0107.147] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0107.147] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0107.147] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0107.154] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x83020c) returned 0x1 [0107.154] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0107.155] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0107.294] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0107.301] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0107.301] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0107.301] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x83020c) returned 0x1 [0107.302] SetFocus (hWnd=0x7002e) returned 0x83020c [0107.304] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0107.305] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0107.305] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0107.306] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0107.306] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x83020c, lParam=0x0) returned 0x0 [0107.310] IsWindow (hWnd=0x7002e) returned 1 [0107.310] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0107.310] IsWindow (hWnd=0x7002e) returned 1 [0107.310] SetFocus (hWnd=0x7002e) returned 0x7002e [0107.310] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0107.310] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0107.310] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0107.310] GetProcessWindowStation () returned 0x13c [0107.310] GetActiveWindow () returned 0x7002e [0107.310] GetCurrentActCtx (in: lphActCtx=0x8fe8f0 | out: lphActCtx=0x8fe8f0*=0x9f8cbc) returned 1 [0107.310] GetCurrentThreadId () returned 0x540 [0107.311] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4e3a, lParam=0x0) returned 1 [0107.311] IsWindowVisible (hWnd=0x7002e) returned 0 [0107.311] IsWindowVisible (hWnd=0x4020e) returned 0 [0107.311] IsWindowVisible (hWnd=0x60044) returned 0 [0107.311] IsWindowVisible (hWnd=0x2021a) returned 0 [0107.311] IsWindowVisible (hWnd=0x8004a) returned 0 [0107.312] GetActiveWindow () returned 0x7002e [0107.312] GetFocus () returned 0x7002e [0107.312] MessageBoxW (hWnd=0x7002e, lpText="h+Rl+7lnKQBG9lOqSM6kYQ==", lpCaption="", uType=0x0) returned 1 [0107.313] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0107.313] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0107.314] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0107.314] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0107.314] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0107.315] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0107.324] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x84020c) returned 0x1 [0107.325] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0107.325] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0107.483] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0107.490] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0107.490] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0107.490] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x84020c) returned 0x1 [0107.494] SetFocus (hWnd=0x7002e) returned 0x84020c [0107.496] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0107.497] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0107.497] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0107.497] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0107.497] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x84020c, lParam=0x0) returned 0x0 [0107.501] IsWindow (hWnd=0x7002e) returned 1 [0107.501] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0107.501] IsWindow (hWnd=0x7002e) returned 1 [0107.501] SetFocus (hWnd=0x7002e) returned 0x7002e [0107.502] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0107.502] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0107.502] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0107.502] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", nBufferLength=0x105, lpBuffer=0x8fe4ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", lpFilePart=0x0) returned 0x66 [0107.502] GetLastError () returned 0x0 [0107.502] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", dwFileAttributes=0x80) returned 0 [0107.504] GetLastError () returned 0x5 [0107.506] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", nBufferLength=0x105, lpBuffer=0x8fe3bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", lpFilePart=0x0) returned 0x66 [0107.506] GetLastError () returned 0x5 [0107.506] SetErrorMode (uMode=0x1) returned 0x0 [0107.506] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0107.506] GetLastError () returned 0x0 [0107.506] GetFileType (hFile=0x3f4) returned 0x1 [0107.506] SetErrorMode (uMode=0x0) returned 0x1 [0107.506] GetFileType (hFile=0x3f4) returned 0x1 [0107.506] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x8fe970 | out: lpFileSizeHigh=0x8fe970*=0x0) returned 0x1fad1 [0107.506] GetLastError () returned 0x0 [0107.510] ReadFile (in: hFile=0x3f4, lpBuffer=0x3a81d20, nNumberOfBytesToRead=0x1fad1, lpNumberOfBytesRead=0x8fe918, lpOverlapped=0x0 | out: lpBuffer=0x3a81d20*, lpNumberOfBytesRead=0x8fe918*=0x1fad1, lpOverlapped=0x0) returned 1 [0107.515] GetLastError () returned 0x0 [0107.515] CloseHandle (hObject=0x3f4) returned 1 [0107.515] GetLastError () returned 0x0 [0107.515] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0107.515] GetLastError () returned 0x0 [0107.515] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8c0 | out: phKey=0x8fe8c0*=0x9f6720) returned 1 [0107.516] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0107.516] GetLastError () returned 0x0 [0107.516] CryptSetKeyParam (hKey=0x9f6720, dwParam=0x4, pbData=0x2b6334c*=0x1, dwFlags=0x0) returned 1 [0107.516] GetLastError () returned 0x0 [0107.516] CryptSetKeyParam (hKey=0x9f6720, dwParam=0x1, pbData=0x2b63318, dwFlags=0x0) returned 1 [0107.516] GetLastError () returned 0x0 [0107.518] CryptEncrypt (in: hKey=0x9f6720, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3aa1810*, pdwDataLen=0x8fe978*=0x1fae0, dwBufLen=0x1fae0 | out: pbData=0x3aa1810*, pdwDataLen=0x8fe978*=0x1fae0) returned 1 [0107.519] GetLastError () returned 0x0 [0107.519] CryptEncrypt (in: hKey=0x9f6720, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b63370*, pdwDataLen=0x8fe980*=0x0, dwBufLen=0x10 | out: pbData=0x2b63370*, pdwDataLen=0x8fe980*=0x10) returned 1 [0107.519] GetLastError () returned 0x0 [0107.519] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", nBufferLength=0x105, lpBuffer=0x8fe3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", lpFilePart=0x0) returned 0x66 [0107.519] GetLastError () returned 0x0 [0107.519] SetErrorMode (uMode=0x1) returned 0x0 [0107.519] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0107.519] GetLastError () returned 0x5 [0107.521] SetErrorMode (uMode=0x0) returned 0x1 [0107.522] GetProcessWindowStation () returned 0x13c [0107.522] GetActiveWindow () returned 0x7002e [0107.522] GetCurrentActCtx (in: lphActCtx=0x8fe8f0 | out: lphActCtx=0x8fe8f0*=0x9f8cbc) returned 1 [0107.522] GetCurrentThreadId () returned 0x540 [0107.523] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4a1a, lParam=0x0) returned 1 [0107.523] IsWindowVisible (hWnd=0x7002e) returned 0 [0107.523] IsWindowVisible (hWnd=0x4020e) returned 0 [0107.523] IsWindowVisible (hWnd=0x60044) returned 0 [0107.523] IsWindowVisible (hWnd=0x2021a) returned 0 [0107.523] IsWindowVisible (hWnd=0x8004a) returned 0 [0107.523] GetActiveWindow () returned 0x7002e [0107.523] GetFocus () returned 0x7002e [0107.523] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0107.524] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0107.525] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0107.525] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0107.526] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0107.526] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0107.526] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0107.532] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x85020c) returned 0x1 [0107.533] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0107.533] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0107.687] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0107.695] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0107.695] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0107.695] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x85020c) returned 0x1 [0107.696] SetFocus (hWnd=0x7002e) returned 0x85020c [0107.698] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0107.699] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0107.699] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0107.700] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0107.700] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x85020c, lParam=0x0) returned 0x0 [0107.704] IsWindow (hWnd=0x7002e) returned 1 [0107.704] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0107.704] IsWindow (hWnd=0x7002e) returned 1 [0107.704] SetFocus (hWnd=0x7002e) returned 0x7002e [0107.704] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0107.704] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0107.704] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0107.704] GetProcessWindowStation () returned 0x13c [0107.705] GetActiveWindow () returned 0x7002e [0107.705] GetCurrentActCtx (in: lphActCtx=0x8fe8f0 | out: lphActCtx=0x8fe8f0*=0x9f8cbc) returned 1 [0107.705] GetCurrentThreadId () returned 0x540 [0107.705] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4f2a, lParam=0x0) returned 1 [0107.705] IsWindowVisible (hWnd=0x7002e) returned 0 [0107.705] IsWindowVisible (hWnd=0x4020e) returned 0 [0107.705] IsWindowVisible (hWnd=0x60044) returned 0 [0107.705] IsWindowVisible (hWnd=0x2021a) returned 0 [0107.705] IsWindowVisible (hWnd=0x8004a) returned 0 [0107.706] GetActiveWindow () returned 0x7002e [0107.706] GetFocus () returned 0x7002e [0107.706] MessageBoxW (hWnd=0x7002e, lpText="ZnfcUX9Ns1lniO1n8mKuhQ==", lpCaption="", uType=0x0) returned 1 [0107.707] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0107.707] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0107.708] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0107.716] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0107.716] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0107.717] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0107.723] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x86020c) returned 0x1 [0107.724] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0107.724] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0108.043] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0108.051] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0108.051] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0108.051] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x86020c) returned 0x1 [0108.052] SetFocus (hWnd=0x7002e) returned 0x86020c [0108.059] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0108.060] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0108.060] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0108.061] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0108.061] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x86020c, lParam=0x0) returned 0x0 [0108.065] IsWindow (hWnd=0x7002e) returned 1 [0108.065] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0108.065] IsWindow (hWnd=0x7002e) returned 1 [0108.065] SetFocus (hWnd=0x7002e) returned 0x7002e [0108.065] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0108.065] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0108.065] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0108.065] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml", nBufferLength=0x105, lpBuffer=0x8fe4ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml", lpFilePart=0x0) returned 0x64 [0108.065] GetLastError () returned 0x0 [0108.065] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml", dwFileAttributes=0x80) returned 0 [0108.066] GetLastError () returned 0x5 [0108.068] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml", nBufferLength=0x105, lpBuffer=0x8fe3bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml", lpFilePart=0x0) returned 0x64 [0108.068] GetLastError () returned 0x5 [0108.068] SetErrorMode (uMode=0x1) returned 0x0 [0108.068] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0108.068] GetLastError () returned 0x0 [0108.068] GetFileType (hFile=0x3f4) returned 0x1 [0108.068] SetErrorMode (uMode=0x0) returned 0x1 [0108.068] GetFileType (hFile=0x3f4) returned 0x1 [0108.068] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x8fe970 | out: lpFileSizeHigh=0x8fe970*=0x0) returned 0x6cf [0108.068] GetLastError () returned 0x0 [0108.068] ReadFile (in: hFile=0x3f4, lpBuffer=0x2b6a4f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe918, lpOverlapped=0x0 | out: lpBuffer=0x2b6a4f4*, lpNumberOfBytesRead=0x8fe918*=0x6cf, lpOverlapped=0x0) returned 1 [0108.074] GetLastError () returned 0x0 [0108.074] CloseHandle (hObject=0x3f4) returned 1 [0108.075] GetLastError () returned 0x0 [0108.075] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0108.075] GetLastError () returned 0x0 [0108.075] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8c0 | out: phKey=0x8fe8c0*=0x9f66a0) returned 1 [0108.075] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0108.075] GetLastError () returned 0x0 [0108.075] CryptSetKeyParam (hKey=0x9f66a0, dwParam=0x4, pbData=0x2b6b568*=0x1, dwFlags=0x0) returned 1 [0108.075] GetLastError () returned 0x0 [0108.075] CryptSetKeyParam (hKey=0x9f66a0, dwParam=0x1, pbData=0x2b6b534, dwFlags=0x0) returned 1 [0108.075] GetLastError () returned 0x0 [0108.075] CryptEncrypt (in: hKey=0x9f66a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b6b578*, pdwDataLen=0x8fe978*=0x6d0, dwBufLen=0x6d0 | out: pbData=0x2b6b578*, pdwDataLen=0x8fe978*=0x6d0) returned 1 [0108.075] GetLastError () returned 0x0 [0108.075] CryptEncrypt (in: hKey=0x9f66a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b6bc68*, pdwDataLen=0x8fe980*=0x0, dwBufLen=0x10 | out: pbData=0x2b6bc68*, pdwDataLen=0x8fe980*=0x10) returned 1 [0108.075] GetLastError () returned 0x0 [0108.075] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml", nBufferLength=0x105, lpBuffer=0x8fe3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml", lpFilePart=0x0) returned 0x64 [0108.075] GetLastError () returned 0x0 [0108.075] SetErrorMode (uMode=0x1) returned 0x0 [0108.076] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0108.076] GetLastError () returned 0x5 [0108.078] SetErrorMode (uMode=0x0) returned 0x1 [0108.085] GetProcessWindowStation () returned 0x13c [0108.085] GetActiveWindow () returned 0x7002e [0108.085] GetCurrentActCtx (in: lphActCtx=0x8fe8f0 | out: lphActCtx=0x8fe8f0*=0x9f8cbc) returned 1 [0108.085] GetCurrentThreadId () returned 0x540 [0108.086] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4dda, lParam=0x0) returned 1 [0108.086] IsWindowVisible (hWnd=0x7002e) returned 0 [0108.086] IsWindowVisible (hWnd=0x4020e) returned 0 [0108.086] IsWindowVisible (hWnd=0x60044) returned 0 [0108.086] IsWindowVisible (hWnd=0x2021a) returned 0 [0108.086] IsWindowVisible (hWnd=0x8004a) returned 0 [0108.086] GetActiveWindow () returned 0x7002e [0108.086] GetFocus () returned 0x7002e [0108.086] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0108.087] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0108.088] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0108.088] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0108.089] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0108.089] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0108.089] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0108.095] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x87020c) returned 0x1 [0108.096] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0108.096] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0108.193] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0108.203] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0108.203] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0108.203] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x87020c) returned 0x1 [0108.204] SetFocus (hWnd=0x7002e) returned 0x87020c [0108.206] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0108.207] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0108.207] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0108.208] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0108.208] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x87020c, lParam=0x0) returned 0x0 [0108.212] IsWindow (hWnd=0x7002e) returned 1 [0108.212] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0108.212] IsWindow (hWnd=0x7002e) returned 1 [0108.212] SetFocus (hWnd=0x7002e) returned 0x7002e [0108.212] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0108.212] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0108.213] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0108.213] GetProcessWindowStation () returned 0x13c [0108.213] GetActiveWindow () returned 0x7002e [0108.213] GetCurrentActCtx (in: lphActCtx=0x8fe8f0 | out: lphActCtx=0x8fe8f0*=0x9f8cbc) returned 1 [0108.213] GetCurrentThreadId () returned 0x540 [0108.213] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4efa, lParam=0x0) returned 1 [0108.213] IsWindowVisible (hWnd=0x7002e) returned 0 [0108.214] IsWindowVisible (hWnd=0x4020e) returned 0 [0108.214] IsWindowVisible (hWnd=0x60044) returned 0 [0108.214] IsWindowVisible (hWnd=0x2021a) returned 0 [0108.214] IsWindowVisible (hWnd=0x8004a) returned 0 [0108.214] GetActiveWindow () returned 0x7002e [0108.214] GetFocus () returned 0x7002e [0108.214] MessageBoxW (hWnd=0x7002e, lpText="CiW0b9BNQbM7XmXlmalLHg==", lpCaption="", uType=0x0) returned 1 [0108.215] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0108.215] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0108.216] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0108.217] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0108.217] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0108.217] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0108.223] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x88020c) returned 0x1 [0108.224] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0108.224] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0108.404] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0108.412] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0108.412] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0108.412] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x88020c) returned 0x1 [0108.450] SetFocus (hWnd=0x7002e) returned 0x88020c [0108.452] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0108.453] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0108.453] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0108.453] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0108.453] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x88020c, lParam=0x0) returned 0x0 [0108.457] IsWindow (hWnd=0x7002e) returned 1 [0108.458] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0108.458] IsWindow (hWnd=0x7002e) returned 1 [0108.458] SetFocus (hWnd=0x7002e) returned 0x7002e [0108.458] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0108.458] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0108.458] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0108.458] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", nBufferLength=0x105, lpBuffer=0x8fe4ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", lpFilePart=0x0) returned 0x65 [0108.458] GetLastError () returned 0x0 [0108.458] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", dwFileAttributes=0x80) returned 0 [0108.458] GetLastError () returned 0x5 [0108.462] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", nBufferLength=0x105, lpBuffer=0x8fe3bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", lpFilePart=0x0) returned 0x65 [0108.462] GetLastError () returned 0x5 [0108.462] SetErrorMode (uMode=0x1) returned 0x0 [0108.463] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0108.463] GetLastError () returned 0x0 [0108.463] GetFileType (hFile=0x3f4) returned 0x1 [0108.463] SetErrorMode (uMode=0x0) returned 0x1 [0108.463] GetFileType (hFile=0x3f4) returned 0x1 [0108.463] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x8fe970 | out: lpFileSizeHigh=0x8fe970*=0x0) returned 0x70c1 [0108.463] GetLastError () returned 0x0 [0108.463] ReadFile (in: hFile=0x3f4, lpBuffer=0x2b70ba4, nNumberOfBytesToRead=0x70c1, lpNumberOfBytesRead=0x8fe918, lpOverlapped=0x0 | out: lpBuffer=0x2b70ba4*, lpNumberOfBytesRead=0x8fe918*=0x70c1, lpOverlapped=0x0) returned 1 [0108.465] GetLastError () returned 0x0 [0108.465] CloseHandle (hObject=0x3f4) returned 1 [0108.465] GetLastError () returned 0x0 [0108.465] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0108.465] GetLastError () returned 0x0 [0108.466] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8c0 | out: phKey=0x8fe8c0*=0x9f6120) returned 1 [0108.466] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0108.466] GetLastError () returned 0x0 [0108.466] CryptSetKeyParam (hKey=0x9f6120, dwParam=0x4, pbData=0x2b77cdc*=0x1, dwFlags=0x0) returned 1 [0108.466] GetLastError () returned 0x0 [0108.466] CryptSetKeyParam (hKey=0x9f6120, dwParam=0x1, pbData=0x2b77ca8, dwFlags=0x0) returned 1 [0108.466] GetLastError () returned 0x0 [0108.466] CryptEncrypt (in: hKey=0x9f6120, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b77cec*, pdwDataLen=0x8fe978*=0x70d0, dwBufLen=0x70d0 | out: pbData=0x2b77cec*, pdwDataLen=0x8fe978*=0x70d0) returned 1 [0108.466] GetLastError () returned 0x0 [0108.466] CryptEncrypt (in: hKey=0x9f6120, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b7eddc*, pdwDataLen=0x8fe980*=0x0, dwBufLen=0x10 | out: pbData=0x2b7eddc*, pdwDataLen=0x8fe980*=0x10) returned 1 [0108.466] GetLastError () returned 0x0 [0108.466] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", nBufferLength=0x105, lpBuffer=0x8fe3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", lpFilePart=0x0) returned 0x65 [0108.466] GetLastError () returned 0x0 [0108.466] SetErrorMode (uMode=0x1) returned 0x0 [0108.466] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0108.467] GetLastError () returned 0x5 [0108.468] SetErrorMode (uMode=0x0) returned 0x1 [0108.469] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", lpFilePart=0x0) returned 0x57 [0108.469] GetLastError () returned 0x5 [0108.469] SetErrorMode (uMode=0x1) returned 0x0 [0108.469] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f66e0 [0108.469] GetLastError () returned 0x5 [0108.469] FindNextFileW (in: hFindFile=0x9f66e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.469] GetLastError () returned 0x5 [0108.469] FindNextFileW (in: hFindFile=0x9f66e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0108.469] GetLastError () returned 0x5 [0108.469] FindNextFileW (in: hFindFile=0x9f66e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="behavior.xml", cAlternateFileName="")) returned 1 [0108.469] GetLastError () returned 0x5 [0108.470] FindNextFileW (in: hFindFile=0x9f66e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.png", cAlternateFileName="")) returned 1 [0108.470] GetLastError () returned 0x5 [0108.470] FindNextFileW (in: hFindFile=0x9f66e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.png", cAlternateFileName="")) returned 0 [0108.470] GetLastError () returned 0x12 [0108.470] FindClose (in: hFindFile=0x9f66e0 | out: hFindFile=0x9f66e0) returned 1 [0108.470] SetErrorMode (uMode=0x0) returned 0x1 [0108.471] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe3dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x6a [0108.471] GetLastError () returned 0x12 [0108.471] SetErrorMode (uMode=0x1) returned 0x0 [0108.471] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3f4 [0108.473] GetLastError () returned 0x0 [0108.473] GetFileType (hFile=0x3f4) returned 0x1 [0108.473] SetErrorMode (uMode=0x0) returned 0x1 [0108.473] GetFileType (hFile=0x3f4) returned 0x1 [0108.473] WriteFile (in: hFile=0x3f4, lpBuffer=0x2b89bf0*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe934, lpOverlapped=0x0 | out: lpBuffer=0x2b89bf0*, lpNumberOfBytesWritten=0x8fe934*=0xbcb, lpOverlapped=0x0) returned 1 [0108.474] GetLastError () returned 0x0 [0108.474] CloseHandle (hObject=0x3f4) returned 1 [0108.474] GetLastError () returned 0x0 [0108.474] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x43 [0108.474] GetLastError () returned 0x0 [0108.475] SetErrorMode (uMode=0x1) returned 0x0 [0108.475] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3f4 [0108.476] GetLastError () returned 0x0 [0108.476] GetFileType (hFile=0x3f4) returned 0x1 [0108.476] SetErrorMode (uMode=0x0) returned 0x1 [0108.477] GetFileType (hFile=0x3f4) returned 0x1 [0108.477] WriteFile (in: hFile=0x3f4, lpBuffer=0x2b908e8*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe968, lpOverlapped=0x0 | out: lpBuffer=0x2b908e8*, lpNumberOfBytesWritten=0x8fe968*=0xbcb, lpOverlapped=0x0) returned 1 [0108.478] GetLastError () returned 0x0 [0108.478] CloseHandle (hObject=0x3f4) returned 1 [0108.478] GetLastError () returned 0x0 [0108.478] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task", lpFilePart=0x0) returned 0x2e [0108.478] GetLastError () returned 0x0 [0108.478] SetErrorMode (uMode=0x1) returned 0x0 [0108.478] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6160 [0108.478] GetLastError () returned 0x0 [0108.478] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.479] GetLastError () returned 0x0 [0108.479] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd5f4a5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", cAlternateFileName="{07DEB~1")) returned 1 [0108.479] GetLastError () returned 0x0 [0108.479] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 1 [0108.479] GetLastError () returned 0x0 [0108.479] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 0 [0108.479] GetLastError () returned 0x12 [0108.479] FindClose (in: hFindFile=0x9f6160 | out: hFindFile=0x9f6160) returned 1 [0108.479] SetErrorMode (uMode=0x0) returned 0x1 [0108.479] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task", lpFilePart=0x0) returned 0x2e [0108.479] GetLastError () returned 0x12 [0108.480] SetErrorMode (uMode=0x1) returned 0x0 [0108.480] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6760 [0108.480] GetLastError () returned 0x12 [0108.480] FindNextFileW (in: hFindFile=0x9f6760, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.480] GetLastError () returned 0x12 [0108.480] FindNextFileW (in: hFindFile=0x9f6760, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd5f4a5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", cAlternateFileName="{07DEB~1")) returned 1 [0108.480] GetLastError () returned 0x12 [0108.480] FindNextFileW (in: hFindFile=0x9f6760, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 1 [0108.480] GetLastError () returned 0x12 [0108.481] FindNextFileW (in: hFindFile=0x9f6760, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 0 [0108.481] GetLastError () returned 0x12 [0108.481] FindClose (in: hFindFile=0x9f6760 | out: hFindFile=0x9f6760) returned 1 [0108.481] SetErrorMode (uMode=0x0) returned 0x1 [0108.481] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpFilePart=0x0) returned 0x55 [0108.481] GetLastError () returned 0x12 [0108.481] SetErrorMode (uMode=0x1) returned 0x0 [0108.481] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd5f4a5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f66e0 [0108.483] GetLastError () returned 0x12 [0108.483] FindNextFileW (in: hFindFile=0x9f66e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd5f4a5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.483] GetLastError () returned 0x12 [0108.483] FindNextFileW (in: hFindFile=0x9f66e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd5f5c36, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0108.483] GetLastError () returned 0x12 [0108.483] FindNextFileW (in: hFindFile=0x9f66e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49316445, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0108.483] GetLastError () returned 0x12 [0108.484] FindNextFileW (in: hFindFile=0x9f66e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x72ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfol.ico", cAlternateFileName="")) returned 1 [0108.484] GetLastError () returned 0x12 [0108.484] FindNextFileW (in: hFindFile=0x9f66e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14668, dwReserved0=0x0, dwReserved1=0x0, cFileName="pictures.ico", cAlternateFileName="")) returned 1 [0108.484] GetLastError () returned 0x12 [0108.484] FindNextFileW (in: hFindFile=0x9f66e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49362917, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49362917, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49362917, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1 [0108.484] GetLastError () returned 0x12 [0108.484] FindNextFileW (in: hFindFile=0x9f66e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xcaa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ringtones.ico", cAlternateFileName="")) returned 1 [0108.484] GetLastError () returned 0x12 [0108.484] FindNextFileW (in: hFindFile=0x9f66e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x10850, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.ico", cAlternateFileName="")) returned 1 [0108.484] GetLastError () returned 0x12 [0108.485] FindNextFileW (in: hFindFile=0x9f66e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc04b, dwReserved0=0x0, dwReserved1=0x0, cFileName="sync.ico", cAlternateFileName="")) returned 1 [0108.485] GetLastError () returned 0x12 [0108.485] FindNextFileW (in: hFindFile=0x9f66e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49316445, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2aff, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 1 [0108.485] GetLastError () returned 0x12 [0108.485] FindNextFileW (in: hFindFile=0x9f66e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmp.ico", cAlternateFileName="")) returned 1 [0108.485] GetLastError () returned 0x12 [0108.485] FindNextFileW (in: hFindFile=0x9f66e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmp.ico", cAlternateFileName="")) returned 0 [0108.485] GetLastError () returned 0x12 [0108.485] FindClose (in: hFindFile=0x9f66e0 | out: hFindFile=0x9f66e0) returned 1 [0108.486] SetErrorMode (uMode=0x0) returned 0x1 [0108.487] GetProcessWindowStation () returned 0x13c [0108.487] GetActiveWindow () returned 0x7002e [0108.487] GetCurrentActCtx (in: lphActCtx=0x8fe8f0 | out: lphActCtx=0x8fe8f0*=0x9f8cbc) returned 1 [0108.487] GetCurrentThreadId () returned 0x540 [0108.487] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4cea, lParam=0x0) returned 1 [0108.487] IsWindowVisible (hWnd=0x7002e) returned 0 [0108.487] IsWindowVisible (hWnd=0x4020e) returned 0 [0108.487] IsWindowVisible (hWnd=0x60044) returned 0 [0108.487] IsWindowVisible (hWnd=0x2021a) returned 0 [0108.488] IsWindowVisible (hWnd=0x8004a) returned 0 [0108.488] GetActiveWindow () returned 0x7002e [0108.488] GetFocus () returned 0x7002e [0108.488] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0108.489] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0108.489] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0108.490] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0108.490] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0108.490] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0108.491] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0108.499] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x89020c) returned 0x1 [0108.500] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0108.500] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0108.637] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0108.644] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0108.645] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0108.645] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x89020c) returned 0x1 [0108.646] SetFocus (hWnd=0x7002e) returned 0x89020c [0108.650] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0108.651] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0108.651] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0108.652] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0108.652] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x89020c, lParam=0x0) returned 0x0 [0108.656] IsWindow (hWnd=0x7002e) returned 1 [0108.656] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0108.656] IsWindow (hWnd=0x7002e) returned 1 [0108.656] SetFocus (hWnd=0x7002e) returned 0x7002e [0108.656] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0108.656] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0108.657] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0108.657] GetProcessWindowStation () returned 0x13c [0108.657] GetActiveWindow () returned 0x7002e [0108.657] GetCurrentActCtx (in: lphActCtx=0x8fe8f0 | out: lphActCtx=0x8fe8f0*=0x9f8cbc) returned 1 [0108.657] GetCurrentThreadId () returned 0x540 [0108.657] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4b0a, lParam=0x0) returned 1 [0108.657] IsWindowVisible (hWnd=0x7002e) returned 0 [0108.658] IsWindowVisible (hWnd=0x4020e) returned 0 [0108.658] IsWindowVisible (hWnd=0x60044) returned 0 [0108.658] IsWindowVisible (hWnd=0x2021a) returned 0 [0108.658] IsWindowVisible (hWnd=0x8004a) returned 0 [0108.658] GetActiveWindow () returned 0x7002e [0108.658] GetFocus () returned 0x7002e [0108.658] MessageBoxW (hWnd=0x7002e, lpText="a0e+10zQPnEZ+93bK4pFNQ==", lpCaption="", uType=0x0) returned 1 [0108.659] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0108.659] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0108.660] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0108.660] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0108.660] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0108.661] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0108.669] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x8a020c) returned 0x1 [0108.670] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0108.670] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0109.010] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0109.017] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0109.018] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0109.018] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x8a020c) returned 0x1 [0109.019] SetFocus (hWnd=0x7002e) returned 0x8a020c [0109.021] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0109.022] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0109.022] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0109.023] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0109.023] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x8a020c, lParam=0x0) returned 0x0 [0109.027] IsWindow (hWnd=0x7002e) returned 1 [0109.027] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0109.027] IsWindow (hWnd=0x7002e) returned 1 [0109.027] SetFocus (hWnd=0x7002e) returned 0x7002e [0109.027] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0109.027] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0109.027] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0109.027] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", nBufferLength=0x105, lpBuffer=0x8fe4ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", lpFilePart=0x0) returned 0x62 [0109.027] GetLastError () returned 0x0 [0109.027] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", dwFileAttributes=0x80) returned 0 [0109.031] GetLastError () returned 0x5 [0109.034] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", nBufferLength=0x105, lpBuffer=0x8fe3bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", lpFilePart=0x0) returned 0x62 [0109.034] GetLastError () returned 0x5 [0109.034] SetErrorMode (uMode=0x1) returned 0x0 [0109.034] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0109.035] GetLastError () returned 0x0 [0109.035] GetFileType (hFile=0x3f4) returned 0x1 [0109.035] SetErrorMode (uMode=0x0) returned 0x1 [0109.035] GetFileType (hFile=0x3f4) returned 0x1 [0109.035] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x8fe970 | out: lpFileSizeHigh=0x8fe970*=0x0) returned 0x536 [0109.035] GetLastError () returned 0x0 [0109.035] ReadFile (in: hFile=0x3f4, lpBuffer=0x2ba311c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe918, lpOverlapped=0x0 | out: lpBuffer=0x2ba311c*, lpNumberOfBytesRead=0x8fe918*=0x536, lpOverlapped=0x0) returned 1 [0109.036] GetLastError () returned 0x0 [0109.036] CloseHandle (hObject=0x3f4) returned 1 [0109.036] GetLastError () returned 0x0 [0109.036] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0109.036] GetLastError () returned 0x0 [0109.036] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8c0 | out: phKey=0x8fe8c0*=0x9f62e0) returned 1 [0109.037] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0109.037] GetLastError () returned 0x0 [0109.037] CryptSetKeyParam (hKey=0x9f62e0, dwParam=0x4, pbData=0x2ba4190*=0x1, dwFlags=0x0) returned 1 [0109.037] GetLastError () returned 0x0 [0109.037] CryptSetKeyParam (hKey=0x9f62e0, dwParam=0x1, pbData=0x2ba415c, dwFlags=0x0) returned 1 [0109.037] GetLastError () returned 0x0 [0109.037] CryptEncrypt (in: hKey=0x9f62e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2ba41a0*, pdwDataLen=0x8fe978*=0x540, dwBufLen=0x540 | out: pbData=0x2ba41a0*, pdwDataLen=0x8fe978*=0x540) returned 1 [0109.037] GetLastError () returned 0x0 [0109.037] CryptEncrypt (in: hKey=0x9f62e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2ba4700*, pdwDataLen=0x8fe980*=0x0, dwBufLen=0x10 | out: pbData=0x2ba4700*, pdwDataLen=0x8fe980*=0x10) returned 1 [0109.037] GetLastError () returned 0x0 [0109.037] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", nBufferLength=0x105, lpBuffer=0x8fe3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", lpFilePart=0x0) returned 0x62 [0109.037] GetLastError () returned 0x0 [0109.037] SetErrorMode (uMode=0x1) returned 0x0 [0109.037] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0109.037] GetLastError () returned 0x5 [0109.042] SetErrorMode (uMode=0x0) returned 0x1 [0109.043] GetProcessWindowStation () returned 0x13c [0109.043] GetActiveWindow () returned 0x7002e [0109.043] GetCurrentActCtx (in: lphActCtx=0x8fe8f0 | out: lphActCtx=0x8fe8f0*=0x9f8cbc) returned 1 [0109.043] GetCurrentThreadId () returned 0x540 [0109.043] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4e0a, lParam=0x0) returned 1 [0109.043] IsWindowVisible (hWnd=0x7002e) returned 0 [0109.043] IsWindowVisible (hWnd=0x4020e) returned 0 [0109.043] IsWindowVisible (hWnd=0x60044) returned 0 [0109.043] IsWindowVisible (hWnd=0x2021a) returned 0 [0109.044] IsWindowVisible (hWnd=0x8004a) returned 0 [0109.044] GetActiveWindow () returned 0x7002e [0109.044] GetFocus () returned 0x7002e [0109.044] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0109.045] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0109.045] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0109.046] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0109.046] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0109.046] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0109.046] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0109.053] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x8b020c) returned 0x1 [0109.054] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0109.054] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0109.151] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0109.158] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0109.158] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0109.158] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x8b020c) returned 0x1 [0109.159] SetFocus (hWnd=0x7002e) returned 0x8b020c [0109.161] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0109.162] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0109.162] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0109.165] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0109.165] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x8b020c, lParam=0x0) returned 0x0 [0109.170] IsWindow (hWnd=0x7002e) returned 1 [0109.170] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0109.170] IsWindow (hWnd=0x7002e) returned 1 [0109.170] SetFocus (hWnd=0x7002e) returned 0x7002e [0109.170] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0109.170] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0109.170] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0109.170] GetProcessWindowStation () returned 0x13c [0109.170] GetActiveWindow () returned 0x7002e [0109.170] GetCurrentActCtx (in: lphActCtx=0x8fe8f0 | out: lphActCtx=0x8fe8f0*=0x9f8cbc) returned 1 [0109.170] GetCurrentThreadId () returned 0x540 [0109.171] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4a7a, lParam=0x0) returned 1 [0109.171] IsWindowVisible (hWnd=0x7002e) returned 0 [0109.171] IsWindowVisible (hWnd=0x4020e) returned 0 [0109.171] IsWindowVisible (hWnd=0x60044) returned 0 [0109.171] IsWindowVisible (hWnd=0x2021a) returned 0 [0109.171] IsWindowVisible (hWnd=0x8004a) returned 0 [0109.171] GetActiveWindow () returned 0x7002e [0109.171] GetFocus () returned 0x7002e [0109.171] MessageBoxW (hWnd=0x7002e, lpText="BS4UL/k9bw0PU+aBAjH+WA==", lpCaption="", uType=0x0) returned 1 [0109.172] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0109.173] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0109.173] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0109.174] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0109.174] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0109.174] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0109.180] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x8c020c) returned 0x1 [0109.181] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0109.181] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0109.361] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0109.373] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0109.373] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0109.373] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x8c020c) returned 0x1 [0109.375] SetFocus (hWnd=0x7002e) returned 0x8c020c [0109.377] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0109.378] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0109.378] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0109.378] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0109.378] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x8c020c, lParam=0x0) returned 0x0 [0109.385] IsWindow (hWnd=0x7002e) returned 1 [0109.385] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0109.385] IsWindow (hWnd=0x7002e) returned 1 [0109.385] SetFocus (hWnd=0x7002e) returned 0x7002e [0109.385] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0109.385] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0109.385] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0109.385] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml", nBufferLength=0x105, lpBuffer=0x8fe4ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml", lpFilePart=0x0) returned 0x5f [0109.385] GetLastError () returned 0x0 [0109.385] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml", dwFileAttributes=0x80) returned 0 [0109.387] GetLastError () returned 0x5 [0109.389] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml", nBufferLength=0x105, lpBuffer=0x8fe3bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml", lpFilePart=0x0) returned 0x5f [0109.389] GetLastError () returned 0x5 [0109.389] SetErrorMode (uMode=0x1) returned 0x0 [0109.389] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0109.389] GetLastError () returned 0x0 [0109.389] GetFileType (hFile=0x3f4) returned 0x1 [0109.389] SetErrorMode (uMode=0x0) returned 0x1 [0109.389] GetFileType (hFile=0x3f4) returned 0x1 [0109.390] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x8fe970 | out: lpFileSizeHigh=0x8fe970*=0x0) returned 0x2aff [0109.390] GetLastError () returned 0x0 [0109.390] ReadFile (in: hFile=0x3f4, lpBuffer=0x2bb6f00, nNumberOfBytesToRead=0x2aff, lpNumberOfBytesRead=0x8fe918, lpOverlapped=0x0 | out: lpBuffer=0x2bb6f00*, lpNumberOfBytesRead=0x8fe918*=0x2aff, lpOverlapped=0x0) returned 1 [0109.391] GetLastError () returned 0x0 [0109.391] CloseHandle (hObject=0x3f4) returned 1 [0109.391] GetLastError () returned 0x0 [0109.392] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0109.392] GetLastError () returned 0x0 [0109.392] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8c0 | out: phKey=0x8fe8c0*=0x9f66e0) returned 1 [0109.392] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0109.392] GetLastError () returned 0x0 [0109.392] CryptSetKeyParam (hKey=0x9f66e0, dwParam=0x4, pbData=0x2bb9a74*=0x1, dwFlags=0x0) returned 1 [0109.392] GetLastError () returned 0x0 [0109.392] CryptSetKeyParam (hKey=0x9f66e0, dwParam=0x1, pbData=0x2bb9a40, dwFlags=0x0) returned 1 [0109.392] GetLastError () returned 0x0 [0109.392] CryptEncrypt (in: hKey=0x9f66e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bb9a84*, pdwDataLen=0x8fe978*=0x2b00, dwBufLen=0x2b00 | out: pbData=0x2bb9a84*, pdwDataLen=0x8fe978*=0x2b00) returned 1 [0109.392] GetLastError () returned 0x0 [0109.392] CryptEncrypt (in: hKey=0x9f66e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2bbc5a4*, pdwDataLen=0x8fe980*=0x0, dwBufLen=0x10 | out: pbData=0x2bbc5a4*, pdwDataLen=0x8fe980*=0x10) returned 1 [0109.392] GetLastError () returned 0x0 [0109.393] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml", nBufferLength=0x105, lpBuffer=0x8fe3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml", lpFilePart=0x0) returned 0x5f [0109.393] GetLastError () returned 0x0 [0109.393] SetErrorMode (uMode=0x1) returned 0x0 [0109.393] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0109.393] GetLastError () returned 0x5 [0109.395] SetErrorMode (uMode=0x0) returned 0x1 [0109.404] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpFilePart=0x0) returned 0x55 [0109.404] GetLastError () returned 0x5 [0109.404] SetErrorMode (uMode=0x1) returned 0x0 [0109.404] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd5f4a5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f63a0 [0109.404] GetLastError () returned 0x5 [0109.405] FindNextFileW (in: hFindFile=0x9f63a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd5f4a5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.405] GetLastError () returned 0x5 [0109.405] FindNextFileW (in: hFindFile=0x9f63a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd5f5c36, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0109.405] GetLastError () returned 0x5 [0109.405] FindNextFileW (in: hFindFile=0x9f63a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49316445, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0109.405] GetLastError () returned 0x5 [0109.405] FindNextFileW (in: hFindFile=0x9f63a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x72ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfol.ico", cAlternateFileName="")) returned 1 [0109.405] GetLastError () returned 0x5 [0109.405] FindNextFileW (in: hFindFile=0x9f63a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14668, dwReserved0=0x0, dwReserved1=0x0, cFileName="pictures.ico", cAlternateFileName="")) returned 1 [0109.405] GetLastError () returned 0x5 [0109.406] FindNextFileW (in: hFindFile=0x9f63a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49362917, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49362917, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49362917, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1 [0109.406] GetLastError () returned 0x5 [0109.406] FindNextFileW (in: hFindFile=0x9f63a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xcaa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ringtones.ico", cAlternateFileName="")) returned 1 [0109.406] GetLastError () returned 0x5 [0109.406] FindNextFileW (in: hFindFile=0x9f63a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x10850, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.ico", cAlternateFileName="")) returned 1 [0109.406] GetLastError () returned 0x5 [0109.406] FindNextFileW (in: hFindFile=0x9f63a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc04b, dwReserved0=0x0, dwReserved1=0x0, cFileName="sync.ico", cAlternateFileName="")) returned 1 [0109.406] GetLastError () returned 0x5 [0109.406] FindNextFileW (in: hFindFile=0x9f63a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49316445, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2aff, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 1 [0109.406] GetLastError () returned 0x5 [0109.407] FindNextFileW (in: hFindFile=0x9f63a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmp.ico", cAlternateFileName="")) returned 1 [0109.407] GetLastError () returned 0x5 [0109.407] FindNextFileW (in: hFindFile=0x9f63a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmp.ico", cAlternateFileName="")) returned 0 [0109.407] GetLastError () returned 0x12 [0109.407] FindClose (in: hFindFile=0x9f63a0 | out: hFindFile=0x9f63a0) returned 1 [0109.407] SetErrorMode (uMode=0x0) returned 0x1 [0109.407] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US", nBufferLength=0x105, lpBuffer=0x8fe46c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US", lpFilePart=0x0) returned 0x5b [0109.407] GetLastError () returned 0x12 [0109.407] SetErrorMode (uMode=0x1) returned 0x0 [0109.407] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd5f5c36, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6760 [0109.408] GetLastError () returned 0x12 [0109.408] FindNextFileW (in: hFindFile=0x9f6760, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd5f5c36, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.408] GetLastError () returned 0x12 [0109.408] FindNextFileW (in: hFindFile=0x9f6760, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3de910b4, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x11db3100, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1 [0109.408] GetLastError () returned 0x12 [0109.408] FindNextFileW (in: hFindFile=0x9f6760, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3de910b4, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x11db3100, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 0 [0109.408] GetLastError () returned 0x12 [0109.408] FindClose (in: hFindFile=0x9f6760 | out: hFindFile=0x9f6760) returned 1 [0109.408] SetErrorMode (uMode=0x0) returned 0x1 [0109.409] GetProcessWindowStation () returned 0x13c [0109.409] GetActiveWindow () returned 0x7002e [0109.409] GetCurrentActCtx (in: lphActCtx=0x8fe8bc | out: lphActCtx=0x8fe8bc*=0x9f8cbc) returned 1 [0109.409] GetCurrentThreadId () returned 0x540 [0109.409] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4d1a, lParam=0x0) returned 1 [0109.409] IsWindowVisible (hWnd=0x7002e) returned 0 [0109.409] IsWindowVisible (hWnd=0x4020e) returned 0 [0109.409] IsWindowVisible (hWnd=0x60044) returned 0 [0109.410] IsWindowVisible (hWnd=0x2021a) returned 0 [0109.410] IsWindowVisible (hWnd=0x8004a) returned 0 [0109.410] GetActiveWindow () returned 0x7002e [0109.410] GetFocus () returned 0x7002e [0109.410] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0109.411] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0109.411] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0109.412] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0109.412] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0109.412] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0109.413] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0109.421] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x8d020c) returned 0x1 [0109.422] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe174) returned 0x0 [0109.422] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe174) returned 0x0 [0109.718] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0109.726] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdf7c) returned 0x0 [0109.726] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdf7c) returned 0x0 [0109.726] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x8d020c) returned 0x1 [0109.727] SetFocus (hWnd=0x7002e) returned 0x8d020c [0109.729] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0109.731] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0109.731] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0109.731] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0109.731] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x8d020c, lParam=0x0) returned 0x0 [0109.735] IsWindow (hWnd=0x7002e) returned 1 [0109.735] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0109.735] IsWindow (hWnd=0x7002e) returned 1 [0109.735] SetFocus (hWnd=0x7002e) returned 0x7002e [0109.735] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0109.735] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0109.736] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0109.736] GetProcessWindowStation () returned 0x13c [0109.736] GetActiveWindow () returned 0x7002e [0109.736] GetCurrentActCtx (in: lphActCtx=0x8fe8bc | out: lphActCtx=0x8fe8bc*=0x9f8cbc) returned 1 [0109.736] GetCurrentThreadId () returned 0x540 [0109.736] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4e6a, lParam=0x0) returned 1 [0109.736] IsWindowVisible (hWnd=0x7002e) returned 0 [0109.737] IsWindowVisible (hWnd=0x4020e) returned 0 [0109.737] IsWindowVisible (hWnd=0x60044) returned 0 [0109.737] IsWindowVisible (hWnd=0x2021a) returned 0 [0109.737] IsWindowVisible (hWnd=0x8004a) returned 0 [0109.737] GetActiveWindow () returned 0x7002e [0109.737] GetFocus () returned 0x7002e [0109.737] MessageBoxW (hWnd=0x7002e, lpText="KXG1TiTSFthhDYGtbWMQsA==", lpCaption="", uType=0x0) returned 1 [0109.738] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0109.739] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0109.739] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0109.740] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0109.740] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0109.740] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0109.750] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x8e020c) returned 0x1 [0109.751] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe174) returned 0x0 [0109.751] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe174) returned 0x0 [0110.026] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0110.034] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdf7c) returned 0x0 [0110.034] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdf7c) returned 0x0 [0110.034] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x8e020c) returned 0x1 [0110.035] SetFocus (hWnd=0x7002e) returned 0x8e020c [0110.037] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0110.041] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0110.041] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0110.041] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0110.041] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x8e020c, lParam=0x0) returned 0x0 [0110.045] IsWindow (hWnd=0x7002e) returned 1 [0110.045] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0110.045] IsWindow (hWnd=0x7002e) returned 1 [0110.045] SetFocus (hWnd=0x7002e) returned 0x7002e [0110.045] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0110.045] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0110.046] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0110.046] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml", nBufferLength=0x105, lpBuffer=0x8fe4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml", lpFilePart=0x0) returned 0x68 [0110.046] GetLastError () returned 0x0 [0110.046] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml", dwFileAttributes=0x80) returned 0 [0110.046] GetLastError () returned 0x5 [0110.048] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml", nBufferLength=0x105, lpBuffer=0x8fe388, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml", lpFilePart=0x0) returned 0x68 [0110.048] GetLastError () returned 0x5 [0110.048] SetErrorMode (uMode=0x1) returned 0x0 [0110.048] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0110.048] GetLastError () returned 0x0 [0110.048] GetFileType (hFile=0x3f4) returned 0x1 [0110.048] SetErrorMode (uMode=0x0) returned 0x1 [0110.048] GetFileType (hFile=0x3f4) returned 0x1 [0110.048] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x8fe93c | out: lpFileSizeHigh=0x8fe93c*=0x0) returned 0x536 [0110.048] GetLastError () returned 0x0 [0110.049] ReadFile (in: hFile=0x3f4, lpBuffer=0x2bc82c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe8e4, lpOverlapped=0x0 | out: lpBuffer=0x2bc82c0*, lpNumberOfBytesRead=0x8fe8e4*=0x536, lpOverlapped=0x0) returned 1 [0110.052] GetLastError () returned 0x0 [0110.052] CloseHandle (hObject=0x3f4) returned 1 [0110.052] GetLastError () returned 0x0 [0110.052] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0110.052] GetLastError () returned 0x0 [0110.052] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe88c | out: phKey=0x8fe88c*=0x9f6760) returned 1 [0110.052] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0110.052] GetLastError () returned 0x0 [0110.052] CryptSetKeyParam (hKey=0x9f6760, dwParam=0x4, pbData=0x2bc9334*=0x1, dwFlags=0x0) returned 1 [0110.052] GetLastError () returned 0x0 [0110.052] CryptSetKeyParam (hKey=0x9f6760, dwParam=0x1, pbData=0x2bc9300, dwFlags=0x0) returned 1 [0110.052] GetLastError () returned 0x0 [0110.053] CryptEncrypt (in: hKey=0x9f6760, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bc9344*, pdwDataLen=0x8fe944*=0x540, dwBufLen=0x540 | out: pbData=0x2bc9344*, pdwDataLen=0x8fe944*=0x540) returned 1 [0110.053] GetLastError () returned 0x0 [0110.053] CryptEncrypt (in: hKey=0x9f6760, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2bc98a4*, pdwDataLen=0x8fe94c*=0x0, dwBufLen=0x10 | out: pbData=0x2bc98a4*, pdwDataLen=0x8fe94c*=0x10) returned 1 [0110.053] GetLastError () returned 0x0 [0110.053] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml", nBufferLength=0x105, lpBuffer=0x8fe390, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml", lpFilePart=0x0) returned 0x68 [0110.053] GetLastError () returned 0x0 [0110.053] SetErrorMode (uMode=0x1) returned 0x0 [0110.053] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0110.053] GetLastError () returned 0x5 [0110.058] SetErrorMode (uMode=0x0) returned 0x1 [0110.059] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US", nBufferLength=0x105, lpBuffer=0x8fe46c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US", lpFilePart=0x0) returned 0x5b [0110.059] GetLastError () returned 0x5 [0110.059] SetErrorMode (uMode=0x1) returned 0x0 [0110.059] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd5f5c36, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f63a0 [0110.059] GetLastError () returned 0x5 [0110.059] FindNextFileW (in: hFindFile=0x9f63a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd5f5c36, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.059] GetLastError () returned 0x5 [0110.059] FindNextFileW (in: hFindFile=0x9f63a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3de910b4, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x11db3100, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1 [0110.059] GetLastError () returned 0x5 [0110.059] FindNextFileW (in: hFindFile=0x9f63a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3de910b4, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x11db3100, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 0 [0110.060] GetLastError () returned 0x12 [0110.060] FindClose (in: hFindFile=0x9f63a0 | out: hFindFile=0x9f63a0) returned 1 [0110.060] SetErrorMode (uMode=0x0) returned 0x1 [0110.061] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe3a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x6e [0110.061] GetLastError () returned 0x12 [0110.061] SetErrorMode (uMode=0x1) returned 0x0 [0110.061] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3f4 [0110.062] GetLastError () returned 0x0 [0110.062] GetFileType (hFile=0x3f4) returned 0x1 [0110.062] SetErrorMode (uMode=0x0) returned 0x1 [0110.062] GetFileType (hFile=0x3f4) returned 0x1 [0110.063] WriteFile (in: hFile=0x3f4, lpBuffer=0x2bd3914*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe900, lpOverlapped=0x0 | out: lpBuffer=0x2bd3914*, lpNumberOfBytesWritten=0x8fe900*=0xbcb, lpOverlapped=0x0) returned 1 [0110.063] GetLastError () returned 0x0 [0110.064] CloseHandle (hObject=0x3f4) returned 1 [0110.064] GetLastError () returned 0x0 [0110.065] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe3dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x68 [0110.065] GetLastError () returned 0x0 [0110.065] SetErrorMode (uMode=0x1) returned 0x0 [0110.065] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3f4 [0110.065] GetLastError () returned 0x0 [0110.065] GetFileType (hFile=0x3f4) returned 0x1 [0110.065] SetErrorMode (uMode=0x0) returned 0x1 [0110.065] GetFileType (hFile=0x3f4) returned 0x1 [0110.065] WriteFile (in: hFile=0x3f4, lpBuffer=0x2bda6a0*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe934, lpOverlapped=0x0 | out: lpBuffer=0x2bda6a0*, lpNumberOfBytesWritten=0x8fe934*=0xbcb, lpOverlapped=0x0) returned 1 [0110.066] GetLastError () returned 0x0 [0110.066] CloseHandle (hObject=0x3f4) returned 1 [0110.067] GetLastError () returned 0x0 [0110.067] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpFilePart=0x0) returned 0x55 [0110.067] GetLastError () returned 0x0 [0110.067] SetErrorMode (uMode=0x1) returned 0x0 [0110.067] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f63a0 [0110.068] GetLastError () returned 0x0 [0110.068] FindNextFileW (in: hFindFile=0x9f63a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.068] GetLastError () returned 0x0 [0110.069] FindNextFileW (in: hFindFile=0x9f63a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd64b86a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0110.069] GetLastError () returned 0x0 [0110.069] FindNextFileW (in: hFindFile=0x9f63a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0110.069] GetLastError () returned 0x0 [0110.069] FindNextFileW (in: hFindFile=0x9f63a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe3c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_pref.ico", cAlternateFileName="")) returned 1 [0110.069] GetLastError () returned 0x0 [0110.070] FindNextFileW (in: hFindFile=0x9f63a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xebb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_property.ico", cAlternateFileName="")) returned 1 [0110.070] GetLastError () returned 0x0 [0110.070] FindNextFileW (in: hFindFile=0x9f63a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdff5, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_queue.ico", cAlternateFileName="")) returned 1 [0110.070] GetLastError () returned 0x0 [0110.070] FindNextFileW (in: hFindFile=0x9f63a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xec75, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_.ico", cAlternateFileName="")) returned 1 [0110.070] GetLastError () returned 0x0 [0110.070] FindNextFileW (in: hFindFile=0x9f63a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x10654, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_property.ico", cAlternateFileName="")) returned 1 [0110.070] GetLastError () returned 0x0 [0110.070] FindNextFileW (in: hFindFile=0x9f63a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf8c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_settings.ico", cAlternateFileName="")) returned 1 [0110.070] GetLastError () returned 0x0 [0110.071] FindNextFileW (in: hFindFile=0x9f63a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 1 [0110.071] GetLastError () returned 0x0 [0110.071] FindNextFileW (in: hFindFile=0x9f63a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 0 [0110.071] GetLastError () returned 0x12 [0110.071] FindClose (in: hFindFile=0x9f63a0 | out: hFindFile=0x9f63a0) returned 1 [0110.072] SetErrorMode (uMode=0x0) returned 0x1 [0110.075] GetProcessWindowStation () returned 0x13c [0110.075] GetActiveWindow () returned 0x7002e [0110.075] GetCurrentActCtx (in: lphActCtx=0x8fe8f0 | out: lphActCtx=0x8fe8f0*=0x9f8cbc) returned 1 [0110.075] GetCurrentThreadId () returned 0x540 [0110.076] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c49ea, lParam=0x0) returned 1 [0110.076] IsWindowVisible (hWnd=0x7002e) returned 0 [0110.076] IsWindowVisible (hWnd=0x4020e) returned 0 [0110.076] IsWindowVisible (hWnd=0x60044) returned 0 [0110.076] IsWindowVisible (hWnd=0x2021a) returned 0 [0110.076] IsWindowVisible (hWnd=0x8004a) returned 0 [0110.076] GetActiveWindow () returned 0x7002e [0110.076] GetFocus () returned 0x7002e [0110.076] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0110.077] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0110.078] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0110.078] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0110.079] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0110.079] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0110.079] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0110.088] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x8f020c) returned 0x1 [0110.089] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0110.089] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0110.443] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0110.452] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0110.453] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0110.453] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x8f020c) returned 0x1 [0110.454] SetFocus (hWnd=0x7002e) returned 0x8f020c [0110.456] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0110.457] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0110.457] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0110.457] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0110.457] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x8f020c, lParam=0x0) returned 0x0 [0110.462] IsWindow (hWnd=0x7002e) returned 1 [0110.462] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0110.462] IsWindow (hWnd=0x7002e) returned 1 [0110.462] SetFocus (hWnd=0x7002e) returned 0x7002e [0110.462] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0110.462] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0110.462] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0110.462] GetProcessWindowStation () returned 0x13c [0110.462] GetActiveWindow () returned 0x7002e [0110.463] GetCurrentActCtx (in: lphActCtx=0x8fe8f0 | out: lphActCtx=0x8fe8f0*=0x9f8cbc) returned 1 [0110.463] GetCurrentThreadId () returned 0x540 [0110.463] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4a4a, lParam=0x0) returned 1 [0110.463] IsWindowVisible (hWnd=0x7002e) returned 0 [0110.463] IsWindowVisible (hWnd=0x4020e) returned 0 [0110.463] IsWindowVisible (hWnd=0x60044) returned 0 [0110.463] IsWindowVisible (hWnd=0x2021a) returned 0 [0110.463] IsWindowVisible (hWnd=0x8004a) returned 0 [0110.463] GetActiveWindow () returned 0x7002e [0110.463] GetFocus () returned 0x7002e [0110.464] MessageBoxW (hWnd=0x7002e, lpText="a4CB/JFiXMzSHtdURm715A==", lpCaption="", uType=0x0) returned 1 [0110.464] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0110.465] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0110.465] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0110.466] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0110.466] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0110.466] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0110.472] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x90020c) returned 0x1 [0110.473] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0110.473] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1ac) returned 0x0 [0110.857] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0110.864] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0110.864] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfb4) returned 0x0 [0110.864] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x90020c) returned 0x1 [0110.866] SetFocus (hWnd=0x7002e) returned 0x90020c [0110.868] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0110.869] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0110.869] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0110.869] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0110.869] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x90020c, lParam=0x0) returned 0x0 [0110.873] IsWindow (hWnd=0x7002e) returned 1 [0110.873] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0110.874] IsWindow (hWnd=0x7002e) returned 1 [0110.874] SetFocus (hWnd=0x7002e) returned 0x7002e [0110.874] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0110.874] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0110.874] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0110.874] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", nBufferLength=0x105, lpBuffer=0x8fe4ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", lpFilePart=0x0) returned 0x5f [0110.874] GetLastError () returned 0x0 [0110.874] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", dwFileAttributes=0x80) returned 0 [0110.875] GetLastError () returned 0x5 [0110.878] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", nBufferLength=0x105, lpBuffer=0x8fe3bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", lpFilePart=0x0) returned 0x5f [0110.878] GetLastError () returned 0x5 [0110.878] SetErrorMode (uMode=0x1) returned 0x0 [0110.878] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0110.879] GetLastError () returned 0x0 [0110.879] GetFileType (hFile=0x3f4) returned 0x1 [0110.879] SetErrorMode (uMode=0x0) returned 0x1 [0110.879] GetFileType (hFile=0x3f4) returned 0x1 [0110.879] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x8fe970 | out: lpFileSizeHigh=0x8fe970*=0x0) returned 0x2c64 [0110.879] GetLastError () returned 0x0 [0110.879] ReadFile (in: hFile=0x3f4, lpBuffer=0x2bfc648, nNumberOfBytesToRead=0x2c64, lpNumberOfBytesRead=0x8fe918, lpOverlapped=0x0 | out: lpBuffer=0x2bfc648*, lpNumberOfBytesRead=0x8fe918*=0x2c64, lpOverlapped=0x0) returned 1 [0110.886] GetLastError () returned 0x0 [0110.886] CloseHandle (hObject=0x3f4) returned 1 [0110.886] GetLastError () returned 0x0 [0110.886] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0110.887] GetLastError () returned 0x0 [0110.887] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe8c0 | out: phKey=0x8fe8c0*=0x9f63a0) returned 1 [0110.887] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0110.887] GetLastError () returned 0x0 [0110.887] CryptSetKeyParam (hKey=0x9f63a0, dwParam=0x4, pbData=0x2bff320*=0x1, dwFlags=0x0) returned 1 [0110.887] GetLastError () returned 0x0 [0110.887] CryptSetKeyParam (hKey=0x9f63a0, dwParam=0x1, pbData=0x2bff2ec, dwFlags=0x0) returned 1 [0110.887] GetLastError () returned 0x0 [0110.888] CryptEncrypt (in: hKey=0x9f63a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2bff330*, pdwDataLen=0x8fe978*=0x2c70, dwBufLen=0x2c70 | out: pbData=0x2bff330*, pdwDataLen=0x8fe978*=0x2c70) returned 1 [0110.888] GetLastError () returned 0x0 [0110.888] CryptEncrypt (in: hKey=0x9f63a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2c01fc0*, pdwDataLen=0x8fe980*=0x0, dwBufLen=0x10 | out: pbData=0x2c01fc0*, pdwDataLen=0x8fe980*=0x10) returned 1 [0110.888] GetLastError () returned 0x0 [0110.888] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", nBufferLength=0x105, lpBuffer=0x8fe3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", lpFilePart=0x0) returned 0x5f [0110.888] GetLastError () returned 0x0 [0110.888] SetErrorMode (uMode=0x1) returned 0x0 [0110.888] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0110.888] GetLastError () returned 0x5 [0110.890] SetErrorMode (uMode=0x0) returned 0x1 [0110.897] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpFilePart=0x0) returned 0x55 [0110.897] GetLastError () returned 0x5 [0110.897] SetErrorMode (uMode=0x1) returned 0x0 [0110.897] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f60e0 [0110.898] GetLastError () returned 0x5 [0110.898] FindNextFileW (in: hFindFile=0x9f60e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.898] GetLastError () returned 0x5 [0110.898] FindNextFileW (in: hFindFile=0x9f60e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd64b86a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0110.898] GetLastError () returned 0x5 [0110.899] FindNextFileW (in: hFindFile=0x9f60e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0110.899] GetLastError () returned 0x5 [0110.899] FindNextFileW (in: hFindFile=0x9f60e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe3c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_pref.ico", cAlternateFileName="")) returned 1 [0110.899] GetLastError () returned 0x5 [0110.899] FindNextFileW (in: hFindFile=0x9f60e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xebb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_property.ico", cAlternateFileName="")) returned 1 [0110.899] GetLastError () returned 0x5 [0110.899] FindNextFileW (in: hFindFile=0x9f60e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdff5, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_queue.ico", cAlternateFileName="")) returned 1 [0110.899] GetLastError () returned 0x5 [0110.899] FindNextFileW (in: hFindFile=0x9f60e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xec75, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_.ico", cAlternateFileName="")) returned 1 [0110.899] GetLastError () returned 0x5 [0110.900] FindNextFileW (in: hFindFile=0x9f60e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x10654, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_property.ico", cAlternateFileName="")) returned 1 [0110.900] GetLastError () returned 0x5 [0110.900] FindNextFileW (in: hFindFile=0x9f60e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf8c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_settings.ico", cAlternateFileName="")) returned 1 [0110.900] GetLastError () returned 0x5 [0110.900] FindNextFileW (in: hFindFile=0x9f60e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 1 [0110.900] GetLastError () returned 0x5 [0110.900] FindNextFileW (in: hFindFile=0x9f60e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 0 [0110.900] GetLastError () returned 0x12 [0110.900] FindClose (in: hFindFile=0x9f60e0 | out: hFindFile=0x9f60e0) returned 1 [0110.901] SetErrorMode (uMode=0x0) returned 0x1 [0110.901] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US", nBufferLength=0x105, lpBuffer=0x8fe46c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US", lpFilePart=0x0) returned 0x5b [0110.901] GetLastError () returned 0x12 [0110.901] SetErrorMode (uMode=0x1) returned 0x0 [0110.901] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd64b86a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f60e0 [0110.901] GetLastError () returned 0x12 [0110.901] FindNextFileW (in: hFindFile=0x9f60e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd64b86a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.901] GetLastError () returned 0x12 [0110.901] FindNextFileW (in: hFindFile=0x9f60e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bf64479, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x781a2192, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x549d0900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1 [0110.901] GetLastError () returned 0x12 [0110.902] FindNextFileW (in: hFindFile=0x9f60e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bf64479, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x781a2192, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x549d0900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 0 [0110.902] GetLastError () returned 0x12 [0110.902] FindClose (in: hFindFile=0x9f60e0 | out: hFindFile=0x9f60e0) returned 1 [0110.902] SetErrorMode (uMode=0x0) returned 0x1 [0110.903] GetProcessWindowStation () returned 0x13c [0110.903] GetActiveWindow () returned 0x7002e [0110.903] GetCurrentActCtx (in: lphActCtx=0x8fe8bc | out: lphActCtx=0x8fe8bc*=0x9f8cbc) returned 1 [0110.903] GetCurrentThreadId () returned 0x540 [0110.903] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4aaa, lParam=0x0) returned 1 [0110.903] IsWindowVisible (hWnd=0x7002e) returned 0 [0110.904] IsWindowVisible (hWnd=0x4020e) returned 0 [0110.904] IsWindowVisible (hWnd=0x60044) returned 0 [0110.904] IsWindowVisible (hWnd=0x2021a) returned 0 [0110.904] IsWindowVisible (hWnd=0x8004a) returned 0 [0110.904] GetActiveWindow () returned 0x7002e [0110.904] GetFocus () returned 0x7002e [0110.904] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0110.905] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0110.905] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0110.906] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0110.906] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0110.906] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0110.907] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0110.913] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x91020c) returned 0x1 [0110.914] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe174) returned 0x0 [0110.914] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe174) returned 0x0 [0111.276] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0111.283] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdf7c) returned 0x0 [0111.284] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdf7c) returned 0x0 [0111.284] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x91020c) returned 0x1 [0111.285] SetFocus (hWnd=0x7002e) returned 0x91020c [0111.287] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0111.290] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0111.290] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0111.291] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0111.291] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x91020c, lParam=0x0) returned 0x0 [0111.295] IsWindow (hWnd=0x7002e) returned 1 [0111.295] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0111.295] IsWindow (hWnd=0x7002e) returned 1 [0111.295] SetFocus (hWnd=0x7002e) returned 0x7002e [0111.295] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0111.295] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0111.295] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0111.295] GetProcessWindowStation () returned 0x13c [0111.295] GetActiveWindow () returned 0x7002e [0111.295] GetCurrentActCtx (in: lphActCtx=0x8fe8bc | out: lphActCtx=0x8fe8bc*=0x9f8cbc) returned 1 [0111.295] GetCurrentThreadId () returned 0x540 [0111.296] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4ada, lParam=0x0) returned 1 [0111.296] IsWindowVisible (hWnd=0x7002e) returned 0 [0111.296] IsWindowVisible (hWnd=0x4020e) returned 0 [0111.296] IsWindowVisible (hWnd=0x60044) returned 0 [0111.296] IsWindowVisible (hWnd=0x2021a) returned 0 [0111.296] IsWindowVisible (hWnd=0x8004a) returned 0 [0111.296] GetActiveWindow () returned 0x7002e [0111.296] GetFocus () returned 0x7002e [0111.296] MessageBoxW (hWnd=0x7002e, lpText="i1ZiEJM8Z340XVNXjUukUw==", lpCaption="", uType=0x0) returned 1 [0111.297] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0111.298] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0111.298] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0111.299] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0111.299] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0111.299] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0111.308] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x92020c) returned 0x1 [0111.309] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe174) returned 0x0 [0111.309] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe174) returned 0x0 [0111.663] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0111.670] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdf7c) returned 0x0 [0111.670] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdf7c) returned 0x0 [0111.671] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x92020c) returned 0x1 [0111.672] SetFocus (hWnd=0x7002e) returned 0x92020c [0111.674] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0111.675] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0111.675] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0111.675] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0111.676] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x92020c, lParam=0x0) returned 0x0 [0111.682] IsWindow (hWnd=0x7002e) returned 1 [0111.682] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0111.682] IsWindow (hWnd=0x7002e) returned 1 [0111.682] SetFocus (hWnd=0x7002e) returned 0x7002e [0111.682] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0111.682] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0111.682] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0111.682] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml", nBufferLength=0x105, lpBuffer=0x8fe4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml", lpFilePart=0x0) returned 0x68 [0111.683] GetLastError () returned 0x0 [0111.683] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml", dwFileAttributes=0x80) returned 0 [0111.683] GetLastError () returned 0x5 [0111.685] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml", nBufferLength=0x105, lpBuffer=0x8fe388, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml", lpFilePart=0x0) returned 0x68 [0111.685] GetLastError () returned 0x5 [0111.685] SetErrorMode (uMode=0x1) returned 0x0 [0111.685] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0111.685] GetLastError () returned 0x0 [0111.685] GetFileType (hFile=0x3f4) returned 0x1 [0111.685] SetErrorMode (uMode=0x0) returned 0x1 [0111.685] GetFileType (hFile=0x3f4) returned 0x1 [0111.685] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x8fe93c | out: lpFileSizeHigh=0x8fe93c*=0x0) returned 0x5e8 [0111.685] GetLastError () returned 0x0 [0111.685] ReadFile (in: hFile=0x3f4, lpBuffer=0x2c099c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe8e4, lpOverlapped=0x0 | out: lpBuffer=0x2c099c8*, lpNumberOfBytesRead=0x8fe8e4*=0x5e8, lpOverlapped=0x0) returned 1 [0111.687] GetLastError () returned 0x0 [0111.687] CloseHandle (hObject=0x3f4) returned 1 [0111.687] GetLastError () returned 0x0 [0111.687] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0111.687] GetLastError () returned 0x0 [0111.687] CryptDuplicateKey (in: hKey=0x9f5b20, pdwReserved=0x0, dwFlags=0x0, phKey=0x8fe88c | out: phKey=0x8fe88c*=0x9f60e0) returned 1 [0111.687] CryptContextAddRef (hProv=0x9e9e10, pdwReserved=0x0, dwFlags=0x0) returned 1 [0111.687] GetLastError () returned 0x0 [0111.687] CryptSetKeyParam (hKey=0x9f60e0, dwParam=0x4, pbData=0x2c0aa3c*=0x1, dwFlags=0x0) returned 1 [0111.687] GetLastError () returned 0x0 [0111.687] CryptSetKeyParam (hKey=0x9f60e0, dwParam=0x1, pbData=0x2c0aa08, dwFlags=0x0) returned 1 [0111.687] GetLastError () returned 0x0 [0111.688] CryptEncrypt (in: hKey=0x9f60e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2c0aa4c*, pdwDataLen=0x8fe944*=0x5f0, dwBufLen=0x5f0 | out: pbData=0x2c0aa4c*, pdwDataLen=0x8fe944*=0x5f0) returned 1 [0111.688] GetLastError () returned 0x0 [0111.688] CryptEncrypt (in: hKey=0x9f60e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2c0b05c*, pdwDataLen=0x8fe94c*=0x0, dwBufLen=0x10 | out: pbData=0x2c0b05c*, pdwDataLen=0x8fe94c*=0x10) returned 1 [0111.688] GetLastError () returned 0x0 [0111.688] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml", nBufferLength=0x105, lpBuffer=0x8fe390, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml", lpFilePart=0x0) returned 0x68 [0111.688] GetLastError () returned 0x0 [0111.688] SetErrorMode (uMode=0x1) returned 0x0 [0111.688] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0111.688] GetLastError () returned 0x5 [0111.690] SetErrorMode (uMode=0x0) returned 0x1 [0111.691] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US", nBufferLength=0x105, lpBuffer=0x8fe46c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US", lpFilePart=0x0) returned 0x5b [0111.691] GetLastError () returned 0x5 [0111.691] SetErrorMode (uMode=0x1) returned 0x0 [0111.692] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd64b86a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6160 [0111.692] GetLastError () returned 0x5 [0111.692] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd64b86a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.692] GetLastError () returned 0x5 [0111.692] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bf64479, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x781a2192, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x549d0900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1 [0111.692] GetLastError () returned 0x5 [0111.692] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bf64479, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x781a2192, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x549d0900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 0 [0111.692] GetLastError () returned 0x12 [0111.693] FindClose (in: hFindFile=0x9f6160 | out: hFindFile=0x9f6160) returned 1 [0111.693] SetErrorMode (uMode=0x0) returned 0x1 [0111.694] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe3a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x6e [0111.694] GetLastError () returned 0x12 [0111.694] SetErrorMode (uMode=0x1) returned 0x0 [0111.694] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3f4 [0111.695] GetLastError () returned 0x0 [0111.695] GetFileType (hFile=0x3f4) returned 0x1 [0111.695] SetErrorMode (uMode=0x0) returned 0x1 [0111.695] GetFileType (hFile=0x3f4) returned 0x1 [0111.695] WriteFile (in: hFile=0x3f4, lpBuffer=0x2c150cc*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe900, lpOverlapped=0x0 | out: lpBuffer=0x2c150cc*, lpNumberOfBytesWritten=0x8fe900*=0xbcb, lpOverlapped=0x0) returned 1 [0111.696] GetLastError () returned 0x0 [0111.696] CloseHandle (hObject=0x3f4) returned 1 [0111.696] GetLastError () returned 0x0 [0111.697] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe3dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x68 [0111.697] GetLastError () returned 0x0 [0111.697] SetErrorMode (uMode=0x1) returned 0x0 [0111.697] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3f4 [0111.727] GetLastError () returned 0x0 [0111.727] GetFileType (hFile=0x3f4) returned 0x1 [0111.727] SetErrorMode (uMode=0x0) returned 0x1 [0111.727] GetFileType (hFile=0x3f4) returned 0x1 [0111.728] WriteFile (in: hFile=0x3f4, lpBuffer=0x2c1be58*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe934, lpOverlapped=0x0 | out: lpBuffer=0x2c1be58*, lpNumberOfBytesWritten=0x8fe934*=0xbcb, lpOverlapped=0x0) returned 1 [0111.729] GetLastError () returned 0x0 [0111.729] CloseHandle (hObject=0x3f4) returned 1 [0111.729] GetLastError () returned 0x0 [0111.729] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x41 [0111.730] GetLastError () returned 0x0 [0111.730] SetErrorMode (uMode=0x1) returned 0x0 [0111.730] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3f4 [0111.745] GetLastError () returned 0x0 [0111.745] GetFileType (hFile=0x3f4) returned 0x1 [0111.745] SetErrorMode (uMode=0x0) returned 0x1 [0111.745] GetFileType (hFile=0x3f4) returned 0x1 [0111.745] WriteFile (in: hFile=0x3f4, lpBuffer=0x2c22b48*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe968, lpOverlapped=0x0 | out: lpBuffer=0x2c22b48*, lpNumberOfBytesWritten=0x8fe968*=0xbcb, lpOverlapped=0x0) returned 1 [0111.746] GetLastError () returned 0x0 [0111.746] CloseHandle (hObject=0x3f4) returned 1 [0111.747] GetLastError () returned 0x0 [0111.747] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x3c [0111.747] GetLastError () returned 0x0 [0111.747] SetErrorMode (uMode=0x1) returned 0x0 [0111.747] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3f4 [0111.748] GetLastError () returned 0x0 [0111.748] GetFileType (hFile=0x3f4) returned 0x1 [0111.748] SetErrorMode (uMode=0x0) returned 0x1 [0111.748] GetFileType (hFile=0x3f4) returned 0x1 [0111.748] WriteFile (in: hFile=0x3f4, lpBuffer=0x2c29824*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe99c, lpOverlapped=0x0 | out: lpBuffer=0x2c29824*, lpNumberOfBytesWritten=0x8fe99c*=0xbcb, lpOverlapped=0x0) returned 1 [0111.749] GetLastError () returned 0x0 [0111.749] CloseHandle (hObject=0x3f4) returned 1 [0111.749] GetLastError () returned 0x0 [0111.749] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync", nBufferLength=0x105, lpBuffer=0x8fe508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DeviceSync", lpFilePart=0x0) returned 0x27 [0111.749] GetLastError () returned 0x0 [0111.749] SetErrorMode (uMode=0x1) returned 0x0 [0111.749] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6160 [0111.751] GetLastError () returned 0x0 [0111.751] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.751] GetLastError () returned 0x0 [0111.751] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0111.751] GetLastError () returned 0x12 [0111.752] FindClose (in: hFindFile=0x9f6160 | out: hFindFile=0x9f6160) returned 1 [0111.752] SetErrorMode (uMode=0x0) returned 0x1 [0111.752] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync", nBufferLength=0x105, lpBuffer=0x8fe508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DeviceSync", lpFilePart=0x0) returned 0x27 [0111.752] GetLastError () returned 0x12 [0111.752] SetErrorMode (uMode=0x1) returned 0x0 [0111.752] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f61a0 [0111.752] GetLastError () returned 0x12 [0111.752] FindNextFileW (in: hFindFile=0x9f61a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.752] GetLastError () returned 0x12 [0111.752] FindNextFileW (in: hFindFile=0x9f61a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0111.752] GetLastError () returned 0x12 [0111.753] FindClose (in: hFindFile=0x9f61a0 | out: hFindFile=0x9f61a0) returned 1 [0111.753] SetErrorMode (uMode=0x0) returned 0x1 [0111.753] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DeviceSync\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x3a [0111.754] GetLastError () returned 0x12 [0111.754] SetErrorMode (uMode=0x1) returned 0x0 [0111.754] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\devicesync\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3f4 [0111.754] GetLastError () returned 0x0 [0111.754] GetFileType (hFile=0x3f4) returned 0x1 [0111.755] SetErrorMode (uMode=0x0) returned 0x1 [0111.755] GetFileType (hFile=0x3f4) returned 0x1 [0111.755] WriteFile (in: hFile=0x3f4, lpBuffer=0x2c30f70*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe99c, lpOverlapped=0x0 | out: lpBuffer=0x2c30f70*, lpNumberOfBytesWritten=0x8fe99c*=0xbcb, lpOverlapped=0x0) returned 1 [0111.756] GetLastError () returned 0x0 [0111.756] CloseHandle (hObject=0x3f4) returned 1 [0111.756] GetLastError () returned 0x0 [0111.756] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis", nBufferLength=0x105, lpBuffer=0x8fe508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis", lpFilePart=0x0) returned 0x26 [0111.758] GetLastError () returned 0x0 [0111.758] SetErrorMode (uMode=0x1) returned 0x0 [0111.759] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6160 [0111.760] GetLastError () returned 0x0 [0111.760] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.760] GetLastError () returned 0x0 [0111.761] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d545, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AsimovUploader", cAlternateFileName="ASIMOV~1")) returned 1 [0111.761] GetLastError () returned 0x0 [0111.761] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d9a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a88b65e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DownloadedScenarios", cAlternateFileName="DOWNLO~1")) returned 1 [0111.761] GetLastError () returned 0x0 [0111.761] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4d8e7d9f, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4d8e7d9f, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DownloadedSettings", cAlternateFileName="DOWNLO~2")) returned 1 [0111.761] GetLastError () returned 0x0 [0111.761] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8e23c06e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x8e23c06e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETLLogs", cAlternateFileName="")) returned 1 [0111.761] GetLastError () returned 0x0 [0111.761] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b60b8d0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b60b8d0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x666666, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events_CostDeferred.rbs", cAlternateFileName="EVENTS~3.RBS")) returned 1 [0111.761] GetLastError () returned 0x0 [0111.762] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b5e567a, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b5e567a, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x1000000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events_Normal.rbs", cAlternateFileName="EVENTS~1.RBS")) returned 1 [0111.762] GetLastError () returned 0x0 [0111.762] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b60b8d0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b60b8d0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x666666, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events_NormalCritical.rbs", cAlternateFileName="EVENTS~2.RBS")) returned 1 [0111.762] GetLastError () returned 0x0 [0111.762] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b60b8d0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b60b8d0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x333333, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events_Realtime.rbs", cAlternateFileName="EVENTS~4.RBS")) returned 1 [0111.762] GetLastError () returned 0x0 [0111.762] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a029c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalTraceStore", cAlternateFileName="LOCALT~1")) returned 1 [0111.762] GetLastError () returned 0x0 [0111.762] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a3dd985, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8a3dd985, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x28facbb4, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x0, cFileName="osver.txt", cAlternateFileName="")) returned 1 [0111.763] GetLastError () returned 0x0 [0111.763] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfbb1de, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8bfbb1de, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8bfbb1de, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="parse.dat", cAlternateFileName="")) returned 1 [0111.763] GetLastError () returned 0x0 [0111.763] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a06c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sideload", cAlternateFileName="")) returned 1 [0111.763] GetLastError () returned 0x0 [0111.763] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a0bca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Siufloc", cAlternateFileName="")) returned 1 [0111.763] GetLastError () returned 0x0 [0111.763] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4ddac897, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4e4cb173, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftLanding", cAlternateFileName="SOFTLA~1")) returned 1 [0111.763] GetLastError () returned 0x0 [0111.764] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4e4cb173, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4e4cb173, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftLandingStage", cAlternateFileName="SOFTLA~2")) returned 1 [0111.764] GetLastError () returned 0x0 [0111.764] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd6b11c43, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd6b11c43, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TenantStorage", cAlternateFileName="TENANT~1")) returned 1 [0111.764] GetLastError () returned 0x0 [0111.764] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774ff760, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VortexSchemaRequests.dat", cAlternateFileName="VORTEX~1.DAT")) returned 1 [0111.764] GetLastError () returned 0x0 [0111.764] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774ff760, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VortexSchemaRequests.dat", cAlternateFileName="VORTEX~1.DAT")) returned 0 [0111.764] GetLastError () returned 0x12 [0111.764] FindClose (in: hFindFile=0x9f6160 | out: hFindFile=0x9f6160) returned 1 [0111.765] SetErrorMode (uMode=0x0) returned 0x1 [0111.770] GetProcessWindowStation () returned 0x13c [0111.771] GetActiveWindow () returned 0x7002e [0111.771] GetCurrentActCtx (in: lphActCtx=0x8fe958 | out: lphActCtx=0x8fe958*=0x9f8cbc) returned 1 [0111.771] GetCurrentThreadId () returned 0x540 [0111.771] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c50aa, lParam=0x0) returned 1 [0111.772] IsWindowVisible (hWnd=0x7002e) returned 0 [0111.772] IsWindowVisible (hWnd=0x4020e) returned 0 [0111.772] IsWindowVisible (hWnd=0x60044) returned 0 [0111.774] IsWindowVisible (hWnd=0x2021a) returned 0 [0111.774] IsWindowVisible (hWnd=0x8004a) returned 0 [0111.774] GetActiveWindow () returned 0x7002e [0111.774] GetFocus () returned 0x7002e [0111.774] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0111.775] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0111.776] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0111.776] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0111.777] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0111.777] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0111.777] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0111.784] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x93020c) returned 0x1 [0111.785] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe214) returned 0x0 [0111.785] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe214) returned 0x0 [0111.951] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0111.958] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe01c) returned 0x0 [0111.958] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe01c) returned 0x0 [0111.958] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x93020c) returned 0x1 [0111.959] SetFocus (hWnd=0x7002e) returned 0x93020c [0111.961] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0111.962] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0111.962] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0111.963] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0111.963] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x93020c, lParam=0x0) returned 0x0 [0111.967] IsWindow (hWnd=0x7002e) returned 1 [0111.967] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0111.967] IsWindow (hWnd=0x7002e) returned 1 [0111.967] SetFocus (hWnd=0x7002e) returned 0x7002e [0111.967] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0111.967] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0111.967] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0111.967] GetProcessWindowStation () returned 0x13c [0111.968] GetActiveWindow () returned 0x7002e [0111.968] GetCurrentActCtx (in: lphActCtx=0x8fe958 | out: lphActCtx=0x8fe958*=0x9f8cbc) returned 1 [0111.968] GetCurrentThreadId () returned 0x540 [0111.968] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4d7a, lParam=0x0) returned 1 [0111.968] IsWindowVisible (hWnd=0x7002e) returned 0 [0111.968] IsWindowVisible (hWnd=0x4020e) returned 0 [0111.968] IsWindowVisible (hWnd=0x60044) returned 0 [0111.968] IsWindowVisible (hWnd=0x2021a) returned 0 [0111.968] IsWindowVisible (hWnd=0x8004a) returned 0 [0111.969] GetActiveWindow () returned 0x7002e [0111.969] GetFocus () returned 0x7002e [0111.969] MessageBoxW (hWnd=0x7002e, lpText="u5+/rbxLjIHzbjMa8aEhrg==", lpCaption="", uType=0x0) returned 1 [0111.969] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0111.970] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0111.971] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0111.971] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0111.971] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0111.971] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0111.980] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x94020c) returned 0x1 [0111.981] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe214) returned 0x0 [0111.981] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe214) returned 0x0 [0112.313] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0112.330] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe01c) returned 0x0 [0112.330] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe01c) returned 0x0 [0112.331] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x94020c) returned 0x1 [0112.332] SetFocus (hWnd=0x7002e) returned 0x94020c [0112.334] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0112.335] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0112.335] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0112.336] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0112.336] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x94020c, lParam=0x0) returned 0x0 [0112.340] IsWindow (hWnd=0x7002e) returned 1 [0112.340] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0112.340] IsWindow (hWnd=0x7002e) returned 1 [0112.340] SetFocus (hWnd=0x7002e) returned 0x7002e [0112.340] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0112.340] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0112.340] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0112.340] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\osver.txt", nBufferLength=0x105, lpBuffer=0x8fe554, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\osver.txt", lpFilePart=0x0) returned 0x30 [0112.340] GetLastError () returned 0x0 [0112.340] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\osver.txt", dwFileAttributes=0x80) returned 0 [0112.342] GetLastError () returned 0x5 [0112.345] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\osver.txt", nBufferLength=0x105, lpBuffer=0x8fe424, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\osver.txt", lpFilePart=0x0) returned 0x30 [0112.345] GetLastError () returned 0x5 [0112.345] SetErrorMode (uMode=0x1) returned 0x0 [0112.345] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\osver.txt" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\osver.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0112.346] GetLastError () returned 0x5 [0112.348] SetErrorMode (uMode=0x0) returned 0x1 [0112.355] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis", nBufferLength=0x105, lpBuffer=0x8fe508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis", lpFilePart=0x0) returned 0x26 [0112.355] GetLastError () returned 0x5 [0112.355] SetErrorMode (uMode=0x1) returned 0x0 [0112.355] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6560 [0112.356] GetLastError () returned 0x5 [0112.356] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.356] GetLastError () returned 0x5 [0112.357] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d545, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AsimovUploader", cAlternateFileName="ASIMOV~1")) returned 1 [0112.357] GetLastError () returned 0x5 [0112.357] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d9a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a88b65e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DownloadedScenarios", cAlternateFileName="DOWNLO~1")) returned 1 [0112.357] GetLastError () returned 0x5 [0112.357] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4d8e7d9f, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4d8e7d9f, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DownloadedSettings", cAlternateFileName="DOWNLO~2")) returned 1 [0112.357] GetLastError () returned 0x5 [0112.357] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8e23c06e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x8e23c06e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETLLogs", cAlternateFileName="")) returned 1 [0112.357] GetLastError () returned 0x5 [0112.357] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b60b8d0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b60b8d0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x666666, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events_CostDeferred.rbs", cAlternateFileName="EVENTS~3.RBS")) returned 1 [0112.357] GetLastError () returned 0x5 [0112.358] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b5e567a, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b5e567a, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x1000000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events_Normal.rbs", cAlternateFileName="EVENTS~1.RBS")) returned 1 [0112.358] GetLastError () returned 0x5 [0112.358] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b60b8d0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b60b8d0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x666666, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events_NormalCritical.rbs", cAlternateFileName="EVENTS~2.RBS")) returned 1 [0112.358] GetLastError () returned 0x5 [0112.358] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b60b8d0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b60b8d0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x333333, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events_Realtime.rbs", cAlternateFileName="EVENTS~4.RBS")) returned 1 [0112.358] GetLastError () returned 0x5 [0112.358] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a029c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalTraceStore", cAlternateFileName="LOCALT~1")) returned 1 [0112.358] GetLastError () returned 0x5 [0112.358] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a3dd985, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8a3dd985, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x28facbb4, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x0, cFileName="osver.txt", cAlternateFileName="")) returned 1 [0112.359] GetLastError () returned 0x5 [0112.359] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfbb1de, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8bfbb1de, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8bfbb1de, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="parse.dat", cAlternateFileName="")) returned 1 [0112.359] GetLastError () returned 0x5 [0112.359] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a06c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sideload", cAlternateFileName="")) returned 1 [0112.359] GetLastError () returned 0x5 [0112.359] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a0bca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Siufloc", cAlternateFileName="")) returned 1 [0112.359] GetLastError () returned 0x5 [0112.359] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4ddac897, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4e4cb173, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftLanding", cAlternateFileName="SOFTLA~1")) returned 1 [0112.359] GetLastError () returned 0x5 [0112.359] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4e4cb173, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4e4cb173, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftLandingStage", cAlternateFileName="SOFTLA~2")) returned 1 [0112.360] GetLastError () returned 0x5 [0112.360] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd6b11c43, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd6b11c43, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TenantStorage", cAlternateFileName="TENANT~1")) returned 1 [0112.360] GetLastError () returned 0x5 [0112.360] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774ff760, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VortexSchemaRequests.dat", cAlternateFileName="VORTEX~1.DAT")) returned 1 [0112.360] GetLastError () returned 0x5 [0112.360] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774ff760, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VortexSchemaRequests.dat", cAlternateFileName="VORTEX~1.DAT")) returned 0 [0112.360] GetLastError () returned 0x12 [0112.360] FindClose (in: hFindFile=0x9f6560 | out: hFindFile=0x9f6560) returned 1 [0112.361] SetErrorMode (uMode=0x0) returned 0x1 [0112.362] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\AsimovUploader", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\AsimovUploader", lpFilePart=0x0) returned 0x35 [0112.362] GetLastError () returned 0x12 [0112.362] SetErrorMode (uMode=0x1) returned 0x0 [0112.362] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\AsimovUploader\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d545, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f63a0 [0112.363] GetLastError () returned 0x12 [0112.363] FindNextFileW (in: hFindFile=0x9f63a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d545, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.363] GetLastError () returned 0x12 [0112.364] FindNextFileW (in: hFindFile=0x9f63a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d545, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0112.364] GetLastError () returned 0x12 [0112.364] FindClose (in: hFindFile=0x9f63a0 | out: hFindFile=0x9f63a0) returned 1 [0112.364] SetErrorMode (uMode=0x0) returned 0x1 [0112.364] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\AsimovUploader", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\AsimovUploader", lpFilePart=0x0) returned 0x35 [0112.364] GetLastError () returned 0x12 [0112.364] SetErrorMode (uMode=0x1) returned 0x0 [0112.364] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\AsimovUploader\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d545, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6620 [0112.364] GetLastError () returned 0x12 [0112.364] FindNextFileW (in: hFindFile=0x9f6620, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d545, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.364] GetLastError () returned 0x12 [0112.365] FindNextFileW (in: hFindFile=0x9f6620, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d545, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0112.365] GetLastError () returned 0x12 [0112.365] FindClose (in: hFindFile=0x9f6620 | out: hFindFile=0x9f6620) returned 1 [0112.365] SetErrorMode (uMode=0x0) returned 0x1 [0112.365] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\AsimovUploader\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\AsimovUploader\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x48 [0112.365] GetLastError () returned 0x12 [0112.365] SetErrorMode (uMode=0x1) returned 0x0 [0112.365] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\AsimovUploader\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\asimovuploader\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3f4 [0112.367] GetLastError () returned 0x0 [0112.367] GetFileType (hFile=0x3f4) returned 0x1 [0112.367] SetErrorMode (uMode=0x0) returned 0x1 [0112.367] GetFileType (hFile=0x3f4) returned 0x1 [0112.367] WriteFile (in: hFile=0x3f4, lpBuffer=0x2a5b0a8*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe968, lpOverlapped=0x0 | out: lpBuffer=0x2a5b0a8*, lpNumberOfBytesWritten=0x8fe968*=0xbcb, lpOverlapped=0x0) returned 1 [0112.368] GetLastError () returned 0x0 [0112.368] CloseHandle (hObject=0x3f4) returned 1 [0112.369] GetLastError () returned 0x0 [0112.369] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios", lpFilePart=0x0) returned 0x3a [0112.369] GetLastError () returned 0x0 [0112.369] SetErrorMode (uMode=0x1) returned 0x0 [0112.369] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d9a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a88b65e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6120 [0112.369] GetLastError () returned 0x0 [0112.369] FindNextFileW (in: hFindFile=0x9f6120, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d9a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a88b65e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.369] GetLastError () returned 0x0 [0112.369] FindNextFileW (in: hFindFile=0x9f6120, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a88b65e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5eab1ff, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="windows.uif_ondemand.xml.inbox", cAlternateFileName="WINDOW~1.INB")) returned 1 [0112.370] GetLastError () returned 0x0 [0112.370] FindNextFileW (in: hFindFile=0x9f6120, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a88b65e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5eab1ff, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="windows.uif_ondemand.xml.inbox", cAlternateFileName="WINDOW~1.INB")) returned 0 [0112.370] GetLastError () returned 0x12 [0112.370] FindClose (in: hFindFile=0x9f6120 | out: hFindFile=0x9f6120) returned 1 [0112.370] SetErrorMode (uMode=0x0) returned 0x1 [0112.370] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios", lpFilePart=0x0) returned 0x3a [0112.370] GetLastError () returned 0x12 [0112.370] SetErrorMode (uMode=0x1) returned 0x0 [0112.370] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d9a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a88b65e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f61a0 [0112.370] GetLastError () returned 0x12 [0112.371] FindNextFileW (in: hFindFile=0x9f61a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d9a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a88b65e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.371] GetLastError () returned 0x12 [0112.371] FindNextFileW (in: hFindFile=0x9f61a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a88b65e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5eab1ff, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="windows.uif_ondemand.xml.inbox", cAlternateFileName="WINDOW~1.INB")) returned 1 [0112.371] GetLastError () returned 0x12 [0112.371] FindNextFileW (in: hFindFile=0x9f61a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a88b65e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5eab1ff, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="windows.uif_ondemand.xml.inbox", cAlternateFileName="WINDOW~1.INB")) returned 0 [0112.371] GetLastError () returned 0x12 [0112.371] FindClose (in: hFindFile=0x9f61a0 | out: hFindFile=0x9f61a0) returned 1 [0112.371] SetErrorMode (uMode=0x0) returned 0x1 [0112.372] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x4d [0112.372] GetLastError () returned 0x12 [0112.372] SetErrorMode (uMode=0x1) returned 0x0 [0112.372] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedscenarios\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3f4 [0112.372] GetLastError () returned 0x0 [0112.372] GetFileType (hFile=0x3f4) returned 0x1 [0112.372] SetErrorMode (uMode=0x0) returned 0x1 [0112.372] GetFileType (hFile=0x3f4) returned 0x1 [0112.372] WriteFile (in: hFile=0x3f4, lpBuffer=0x2a67654*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe968, lpOverlapped=0x0 | out: lpBuffer=0x2a67654*, lpNumberOfBytesWritten=0x8fe968*=0xbcb, lpOverlapped=0x0) returned 1 [0112.373] GetLastError () returned 0x0 [0112.373] CloseHandle (hObject=0x3f4) returned 1 [0112.373] GetLastError () returned 0x0 [0112.373] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings", lpFilePart=0x0) returned 0x39 [0112.373] GetLastError () returned 0x0 [0112.373] SetErrorMode (uMode=0x1) returned 0x0 [0112.374] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4d8e7d9f, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4d8e7d9f, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f65a0 [0112.376] GetLastError () returned 0x0 [0112.376] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4d8e7d9f, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4d8e7d9f, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.376] GetLastError () returned 0x0 [0112.376] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x69d9f6fd, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x69d9f6fd, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x69e5dfd5, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x623b, dwReserved0=0x0, dwReserved1=0x0, cFileName="telemetry.ASM-WindowsDefault.json", cAlternateFileName="TELEME~1.JSO")) returned 1 [0112.376] GetLastError () returned 0x0 [0112.376] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5eab1ff, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x44f, dwReserved0=0x0, dwReserved1=0x0, cFileName="telemetry.ASM-WindowsDefault.json.bk", cAlternateFileName="TELEME~1.BK")) returned 1 [0112.376] GetLastError () returned 0x0 [0112.376] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xb0c71bce, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0xb0c71bce, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xb0fb9083, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TELEMETRY.ASM-WINDOWSSQ.json", cAlternateFileName="TELEME~4.JSO")) returned 1 [0112.376] GetLastError () returned 0x0 [0112.377] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x2d95e660, ftCreationTime.dwHighDateTime=0x1d336e0, ftLastAccessTime.dwLowDateTime=0x2d95e660, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2e6edc8f, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x90, dwReserved0=0x0, dwReserved1=0x0, cFileName="telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json", cAlternateFileName="TEA386~1.JSO")) returned 1 [0112.377] GetLastError () returned 0x0 [0112.377] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7ea85252, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x7ea85252, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7f139471, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x90, dwReserved0=0x0, dwReserved1=0x0, cFileName="telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json", cAlternateFileName="TELEME~2.JSO")) returned 1 [0112.377] GetLastError () returned 0x0 [0112.377] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7f139471, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x7f139471, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7f4f45ae, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x90, dwReserved0=0x0, dwReserved1=0x0, cFileName="telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json", cAlternateFileName="TELEME~3.JSO")) returned 1 [0112.377] GetLastError () returned 0x0 [0112.377] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x698688ac, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x698688ac, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x69d06e63, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0xba4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="utc.app.json", cAlternateFileName="UTCAPP~1.JSO")) returned 1 [0112.377] GetLastError () returned 0x0 [0112.377] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x67f, dwReserved0=0x0, dwReserved1=0x0, cFileName="utc.app.json.bk", cAlternateFileName="UTCAPP~1.BK")) returned 1 [0112.378] GetLastError () returned 0x0 [0112.378] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7e8bf97d, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x7e8bf97d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7ea85252, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x8e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="utc.cert.json", cAlternateFileName="UTCCER~1.JSO")) returned 1 [0112.378] GetLastError () returned 0x0 [0112.378] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7e8bf97d, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x7e8bf97d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7ea85252, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x8e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="utc.cert.json", cAlternateFileName="UTCCER~1.JSO")) returned 0 [0112.378] GetLastError () returned 0x12 [0112.378] FindClose (in: hFindFile=0x9f65a0 | out: hFindFile=0x9f65a0) returned 1 [0112.379] SetErrorMode (uMode=0x0) returned 0x1 [0112.380] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings", lpFilePart=0x0) returned 0x39 [0112.380] GetLastError () returned 0x12 [0112.380] SetErrorMode (uMode=0x1) returned 0x0 [0112.380] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4d8e7d9f, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4d8e7d9f, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6220 [0112.380] GetLastError () returned 0x12 [0112.381] FindNextFileW (in: hFindFile=0x9f6220, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4d8e7d9f, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4d8e7d9f, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.381] GetLastError () returned 0x12 [0112.381] FindNextFileW (in: hFindFile=0x9f6220, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x69d9f6fd, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x69d9f6fd, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x69e5dfd5, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x623b, dwReserved0=0x0, dwReserved1=0x0, cFileName="telemetry.ASM-WindowsDefault.json", cAlternateFileName="TELEME~1.JSO")) returned 1 [0112.381] GetLastError () returned 0x12 [0112.381] FindNextFileW (in: hFindFile=0x9f6220, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5eab1ff, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x44f, dwReserved0=0x0, dwReserved1=0x0, cFileName="telemetry.ASM-WindowsDefault.json.bk", cAlternateFileName="TELEME~1.BK")) returned 1 [0112.381] GetLastError () returned 0x12 [0112.381] FindNextFileW (in: hFindFile=0x9f6220, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xb0c71bce, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0xb0c71bce, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xb0fb9083, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TELEMETRY.ASM-WINDOWSSQ.json", cAlternateFileName="TELEME~4.JSO")) returned 1 [0112.381] GetLastError () returned 0x12 [0112.383] FindNextFileW (in: hFindFile=0x9f6220, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x2d95e660, ftCreationTime.dwHighDateTime=0x1d336e0, ftLastAccessTime.dwLowDateTime=0x2d95e660, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2e6edc8f, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x90, dwReserved0=0x0, dwReserved1=0x0, cFileName="telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json", cAlternateFileName="TEA386~1.JSO")) returned 1 [0112.383] GetLastError () returned 0x12 [0112.383] FindNextFileW (in: hFindFile=0x9f6220, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7ea85252, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x7ea85252, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7f139471, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x90, dwReserved0=0x0, dwReserved1=0x0, cFileName="telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json", cAlternateFileName="TELEME~2.JSO")) returned 1 [0112.383] GetLastError () returned 0x12 [0112.384] FindNextFileW (in: hFindFile=0x9f6220, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7f139471, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x7f139471, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7f4f45ae, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x90, dwReserved0=0x0, dwReserved1=0x0, cFileName="telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json", cAlternateFileName="TELEME~3.JSO")) returned 1 [0112.384] GetLastError () returned 0x12 [0112.384] FindNextFileW (in: hFindFile=0x9f6220, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x698688ac, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x698688ac, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x69d06e63, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0xba4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="utc.app.json", cAlternateFileName="UTCAPP~1.JSO")) returned 1 [0112.384] GetLastError () returned 0x12 [0112.384] FindNextFileW (in: hFindFile=0x9f6220, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x67f, dwReserved0=0x0, dwReserved1=0x0, cFileName="utc.app.json.bk", cAlternateFileName="UTCAPP~1.BK")) returned 1 [0112.384] GetLastError () returned 0x12 [0112.384] FindNextFileW (in: hFindFile=0x9f6220, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7e8bf97d, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x7e8bf97d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7ea85252, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x8e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="utc.cert.json", cAlternateFileName="UTCCER~1.JSO")) returned 1 [0112.384] GetLastError () returned 0x12 [0112.384] FindNextFileW (in: hFindFile=0x9f6220, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7e8bf97d, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x7e8bf97d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7ea85252, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x8e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="utc.cert.json", cAlternateFileName="UTCCER~1.JSO")) returned 0 [0112.384] GetLastError () returned 0x12 [0112.385] FindClose (in: hFindFile=0x9f6220 | out: hFindFile=0x9f6220) returned 1 [0112.385] SetErrorMode (uMode=0x0) returned 0x1 [0112.385] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x4c [0112.385] GetLastError () returned 0x12 [0112.385] SetErrorMode (uMode=0x1) returned 0x0 [0112.386] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3f4 [0112.386] GetLastError () returned 0x0 [0112.386] GetFileType (hFile=0x3f4) returned 0x1 [0112.386] SetErrorMode (uMode=0x0) returned 0x1 [0112.387] GetFileType (hFile=0x3f4) returned 0x1 [0112.387] WriteFile (in: hFile=0x3f4, lpBuffer=0x2a960e8*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe968, lpOverlapped=0x0 | out: lpBuffer=0x2a960e8*, lpNumberOfBytesWritten=0x8fe968*=0xbcb, lpOverlapped=0x0) returned 1 [0112.387] GetLastError () returned 0x0 [0112.388] CloseHandle (hObject=0x3f4) returned 1 [0112.388] GetLastError () returned 0x0 [0112.388] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs", lpFilePart=0x0) returned 0x2e [0112.388] GetLastError () returned 0x0 [0112.388] SetErrorMode (uMode=0x1) returned 0x0 [0112.388] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8e23c06e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x8e23c06e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f61e0 [0112.389] GetLastError () returned 0x0 [0112.389] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8e23c06e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x8e23c06e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.389] GetLastError () returned 0x0 [0112.390] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d5cadbc, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2d5cadbc, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoLogger", cAlternateFileName="AUTOLO~1")) returned 1 [0112.390] GetLastError () returned 0x0 [0112.390] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69f80c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ScenarioShutdownLogger", cAlternateFileName="SCENAR~1")) returned 1 [0112.390] GetLastError () returned 0x0 [0112.390] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d6afbff, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2d6afbff, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShutdownLogger", cAlternateFileName="SHUTDO~1")) returned 1 [0112.390] GetLastError () returned 0x0 [0112.390] FindNextFileW (in: hFindFile=0x9f61e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d6afbff, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2d6afbff, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShutdownLogger", cAlternateFileName="SHUTDO~1")) returned 0 [0112.390] GetLastError () returned 0x12 [0112.390] FindClose (in: hFindFile=0x9f61e0 | out: hFindFile=0x9f61e0) returned 1 [0112.391] SetErrorMode (uMode=0x0) returned 0x1 [0112.391] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs", lpFilePart=0x0) returned 0x2e [0112.391] GetLastError () returned 0x12 [0112.391] SetErrorMode (uMode=0x1) returned 0x0 [0112.391] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8e23c06e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x8e23c06e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6560 [0112.392] GetLastError () returned 0x12 [0112.392] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8e23c06e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x8e23c06e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.392] GetLastError () returned 0x12 [0112.392] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d5cadbc, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2d5cadbc, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoLogger", cAlternateFileName="AUTOLO~1")) returned 1 [0112.392] GetLastError () returned 0x12 [0112.392] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69f80c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ScenarioShutdownLogger", cAlternateFileName="SCENAR~1")) returned 1 [0112.392] GetLastError () returned 0x12 [0112.392] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d6afbff, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2d6afbff, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShutdownLogger", cAlternateFileName="SHUTDO~1")) returned 1 [0112.392] GetLastError () returned 0x12 [0112.393] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d6afbff, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2d6afbff, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShutdownLogger", cAlternateFileName="SHUTDO~1")) returned 0 [0112.393] GetLastError () returned 0x12 [0112.393] FindClose (in: hFindFile=0x9f6560 | out: hFindFile=0x9f6560) returned 1 [0112.393] SetErrorMode (uMode=0x0) returned 0x1 [0112.393] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger", lpFilePart=0x0) returned 0x39 [0112.393] GetLastError () returned 0x12 [0112.393] SetErrorMode (uMode=0x1) returned 0x0 [0112.394] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d5cadbc, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0xcd8d859b, ftLastWriteTime.dwHighDateTime=0x1d34734, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f66a0 [0112.394] GetLastError () returned 0x12 [0112.394] FindNextFileW (in: hFindFile=0x9f66a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d5cadbc, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0xcd8d859b, ftLastWriteTime.dwHighDateTime=0x1d34734, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.394] GetLastError () returned 0x12 [0112.395] FindNextFileW (in: hFindFile=0x9f66a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd8d859b, ftCreationTime.dwHighDateTime=0x1d34734, ftLastAccessTime.dwLowDateTime=0xcd8d859b, ftLastAccessTime.dwHighDateTime=0x1d34734, ftLastWriteTime.dwLowDateTime=0xac487de2, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x30000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoLogger-Diagtrack-Listener.etl", cAlternateFileName="AUTOLO~1.ETL")) returned 1 [0112.395] GetLastError () returned 0x12 [0112.395] FindNextFileW (in: hFindFile=0x9f66a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd8d859b, ftCreationTime.dwHighDateTime=0x1d34734, ftLastAccessTime.dwLowDateTime=0xcd8d859b, ftLastAccessTime.dwHighDateTime=0x1d34734, ftLastWriteTime.dwLowDateTime=0xac487de2, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x30000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoLogger-Diagtrack-Listener.etl", cAlternateFileName="AUTOLO~1.ETL")) returned 0 [0112.395] GetLastError () returned 0x12 [0112.395] FindClose (in: hFindFile=0x9f66a0 | out: hFindFile=0x9f66a0) returned 1 [0112.395] SetErrorMode (uMode=0x0) returned 0x1 [0112.395] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger", lpFilePart=0x0) returned 0x39 [0112.395] GetLastError () returned 0x12 [0112.395] SetErrorMode (uMode=0x1) returned 0x0 [0112.395] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcd8d859b, ftLastAccessTime.dwHighDateTime=0x1d34734, ftLastWriteTime.dwLowDateTime=0xcd8d859b, ftLastWriteTime.dwHighDateTime=0x1d34734, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6160 [0112.395] GetLastError () returned 0x12 [0112.395] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcd8d859b, ftLastAccessTime.dwHighDateTime=0x1d34734, ftLastWriteTime.dwLowDateTime=0xcd8d859b, ftLastWriteTime.dwHighDateTime=0x1d34734, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.395] GetLastError () returned 0x12 [0112.396] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd8d859b, ftCreationTime.dwHighDateTime=0x1d34734, ftLastAccessTime.dwLowDateTime=0xcd8d859b, ftLastAccessTime.dwHighDateTime=0x1d34734, ftLastWriteTime.dwLowDateTime=0xac487de2, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x30000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoLogger-Diagtrack-Listener.etl", cAlternateFileName="AUTOLO~1.ETL")) returned 1 [0112.396] GetLastError () returned 0x12 [0112.396] FindNextFileW (in: hFindFile=0x9f6160, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd8d859b, ftCreationTime.dwHighDateTime=0x1d34734, ftLastAccessTime.dwLowDateTime=0xcd8d859b, ftLastAccessTime.dwHighDateTime=0x1d34734, ftLastWriteTime.dwLowDateTime=0xac487de2, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x30000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoLogger-Diagtrack-Listener.etl", cAlternateFileName="AUTOLO~1.ETL")) returned 0 [0112.396] GetLastError () returned 0x12 [0112.396] FindClose (in: hFindFile=0x9f6160 | out: hFindFile=0x9f6160) returned 1 [0112.396] SetErrorMode (uMode=0x0) returned 0x1 [0112.396] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe3dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x4c [0112.396] GetLastError () returned 0x12 [0112.396] SetErrorMode (uMode=0x1) returned 0x0 [0112.396] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\etllogs\\autologger\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3f4 [0112.397] GetLastError () returned 0x0 [0112.397] GetFileType (hFile=0x3f4) returned 0x1 [0112.397] SetErrorMode (uMode=0x0) returned 0x1 [0112.397] GetFileType (hFile=0x3f4) returned 0x1 [0112.397] WriteFile (in: hFile=0x3f4, lpBuffer=0x2aa342c*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe934, lpOverlapped=0x0 | out: lpBuffer=0x2aa342c*, lpNumberOfBytesWritten=0x8fe934*=0xbcb, lpOverlapped=0x0) returned 1 [0112.399] GetLastError () returned 0x0 [0112.399] CloseHandle (hObject=0x3f4) returned 1 [0112.400] GetLastError () returned 0x0 [0112.400] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger", lpFilePart=0x0) returned 0x45 [0112.400] GetLastError () returned 0x0 [0112.400] SetErrorMode (uMode=0x1) returned 0x0 [0112.400] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69f80c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6560 [0112.400] GetLastError () returned 0x0 [0112.400] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69f80c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.400] GetLastError () returned 0x0 [0112.400] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69f80c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0112.400] GetLastError () returned 0x12 [0112.401] FindClose (in: hFindFile=0x9f6560 | out: hFindFile=0x9f6560) returned 1 [0112.401] SetErrorMode (uMode=0x0) returned 0x1 [0112.401] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger", lpFilePart=0x0) returned 0x45 [0112.401] GetLastError () returned 0x12 [0112.401] SetErrorMode (uMode=0x1) returned 0x0 [0112.401] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69f80c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f67e0 [0112.401] GetLastError () returned 0x12 [0112.401] FindNextFileW (in: hFindFile=0x9f67e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69f80c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.401] GetLastError () returned 0x12 [0112.401] FindNextFileW (in: hFindFile=0x9f67e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69f80c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0112.401] GetLastError () returned 0x12 [0112.401] FindClose (in: hFindFile=0x9f67e0 | out: hFindFile=0x9f67e0) returned 1 [0112.401] SetErrorMode (uMode=0x0) returned 0x1 [0112.401] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe3dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x58 [0112.402] GetLastError () returned 0x12 [0112.402] SetErrorMode (uMode=0x1) returned 0x0 [0112.402] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\etllogs\\scenarioshutdownlogger\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3f4 [0112.403] GetLastError () returned 0x0 [0112.403] GetFileType (hFile=0x3f4) returned 0x1 [0112.403] SetErrorMode (uMode=0x0) returned 0x1 [0112.403] GetFileType (hFile=0x3f4) returned 0x1 [0112.403] WriteFile (in: hFile=0x3f4, lpBuffer=0x2aaaec0*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe934, lpOverlapped=0x0 | out: lpBuffer=0x2aaaec0*, lpNumberOfBytesWritten=0x8fe934*=0xbcb, lpOverlapped=0x0) returned 1 [0112.404] GetLastError () returned 0x0 [0112.404] CloseHandle (hObject=0x3f4) returned 1 [0112.404] GetLastError () returned 0x0 [0112.404] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger", lpFilePart=0x0) returned 0x3d [0112.404] GetLastError () returned 0x0 [0112.404] SetErrorMode (uMode=0x1) returned 0x0 [0112.404] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d6afbff, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0xb855a1cd, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f65a0 [0112.405] GetLastError () returned 0x0 [0112.405] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d6afbff, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0xb855a1cd, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.405] GetLastError () returned 0x0 [0112.405] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb855a1cd, ftCreationTime.dwHighDateTime=0x1d33839, ftLastAccessTime.dwLowDateTime=0xb855a1cd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbc623573, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoLogger-Diagtrack-Listener.etl", cAlternateFileName="AUTOLO~1.ETL")) returned 1 [0112.405] GetLastError () returned 0x0 [0112.405] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb855a1cd, ftCreationTime.dwHighDateTime=0x1d33839, ftLastAccessTime.dwLowDateTime=0xb855a1cd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbc623573, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoLogger-Diagtrack-Listener.etl", cAlternateFileName="AUTOLO~1.ETL")) returned 0 [0112.405] GetLastError () returned 0x12 [0112.405] FindClose (in: hFindFile=0x9f65a0 | out: hFindFile=0x9f65a0) returned 1 [0112.405] SetErrorMode (uMode=0x0) returned 0x1 [0112.406] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger", nBufferLength=0x105, lpBuffer=0x8fe4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger", lpFilePart=0x0) returned 0x3d [0112.406] GetLastError () returned 0x12 [0112.406] SetErrorMode (uMode=0x1) returned 0x0 [0112.406] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb855a1cd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb855a1cd, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6660 [0112.406] GetLastError () returned 0x12 [0112.406] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb855a1cd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb855a1cd, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.406] GetLastError () returned 0x12 [0112.406] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb855a1cd, ftCreationTime.dwHighDateTime=0x1d33839, ftLastAccessTime.dwLowDateTime=0xb855a1cd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbc623573, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoLogger-Diagtrack-Listener.etl", cAlternateFileName="AUTOLO~1.ETL")) returned 1 [0112.406] GetLastError () returned 0x12 [0112.406] FindNextFileW (in: hFindFile=0x9f6660, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb855a1cd, ftCreationTime.dwHighDateTime=0x1d33839, ftLastAccessTime.dwLowDateTime=0xb855a1cd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbc623573, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoLogger-Diagtrack-Listener.etl", cAlternateFileName="AUTOLO~1.ETL")) returned 0 [0112.406] GetLastError () returned 0x12 [0112.406] FindClose (in: hFindFile=0x9f6660 | out: hFindFile=0x9f6660) returned 1 [0112.406] SetErrorMode (uMode=0x0) returned 0x1 [0112.407] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe3dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x50 [0112.407] GetLastError () returned 0x12 [0112.407] SetErrorMode (uMode=0x1) returned 0x0 [0112.407] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\etllogs\\shutdownlogger\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3f4 [0112.407] GetLastError () returned 0x0 [0112.407] GetFileType (hFile=0x3f4) returned 0x1 [0112.407] SetErrorMode (uMode=0x0) returned 0x1 [0112.407] GetFileType (hFile=0x3f4) returned 0x1 [0112.407] WriteFile (in: hFile=0x3f4, lpBuffer=0x2ab70e8*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe934, lpOverlapped=0x0 | out: lpBuffer=0x2ab70e8*, lpNumberOfBytesWritten=0x8fe934*=0xbcb, lpOverlapped=0x0) returned 1 [0112.408] GetLastError () returned 0x0 [0112.408] CloseHandle (hObject=0x3f4) returned 1 [0112.408] GetLastError () returned 0x0 [0112.409] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x41 [0112.409] GetLastError () returned 0x0 [0112.409] SetErrorMode (uMode=0x1) returned 0x0 [0112.409] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\etllogs\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3f4 [0112.409] GetLastError () returned 0x0 [0112.409] GetFileType (hFile=0x3f4) returned 0x1 [0112.409] SetErrorMode (uMode=0x0) returned 0x1 [0112.409] GetFileType (hFile=0x3f4) returned 0x1 [0112.409] WriteFile (in: hFile=0x3f4, lpBuffer=0x2abddd8*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe968, lpOverlapped=0x0 | out: lpBuffer=0x2abddd8*, lpNumberOfBytesWritten=0x8fe968*=0xbcb, lpOverlapped=0x0) returned 1 [0112.410] GetLastError () returned 0x0 [0112.410] CloseHandle (hObject=0x3f4) returned 1 [0112.410] GetLastError () returned 0x0 [0112.410] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\LocalTraceStore", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\LocalTraceStore", lpFilePart=0x0) returned 0x36 [0112.410] GetLastError () returned 0x0 [0112.410] SetErrorMode (uMode=0x1) returned 0x0 [0112.410] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\LocalTraceStore\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a029c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f67e0 [0112.411] GetLastError () returned 0x0 [0112.411] FindNextFileW (in: hFindFile=0x9f67e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a029c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.411] GetLastError () returned 0x0 [0112.411] FindNextFileW (in: hFindFile=0x9f67e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a029c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0112.411] GetLastError () returned 0x12 [0112.411] FindClose (in: hFindFile=0x9f67e0 | out: hFindFile=0x9f67e0) returned 1 [0112.411] SetErrorMode (uMode=0x0) returned 0x1 [0112.411] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\LocalTraceStore", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\LocalTraceStore", lpFilePart=0x0) returned 0x36 [0112.411] GetLastError () returned 0x12 [0112.411] SetErrorMode (uMode=0x1) returned 0x0 [0112.411] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\LocalTraceStore\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a029c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6120 [0112.411] GetLastError () returned 0x12 [0112.412] FindNextFileW (in: hFindFile=0x9f6120, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a029c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.412] GetLastError () returned 0x12 [0112.412] FindNextFileW (in: hFindFile=0x9f6120, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a029c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0112.412] GetLastError () returned 0x12 [0112.412] FindClose (in: hFindFile=0x9f6120 | out: hFindFile=0x9f6120) returned 1 [0112.412] SetErrorMode (uMode=0x0) returned 0x1 [0112.412] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\LocalTraceStore\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\LocalTraceStore\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x49 [0112.412] GetLastError () returned 0x12 [0112.412] SetErrorMode (uMode=0x1) returned 0x0 [0112.412] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\LocalTraceStore\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\localtracestore\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3f4 [0112.412] GetLastError () returned 0x0 [0112.412] GetFileType (hFile=0x3f4) returned 0x1 [0112.413] SetErrorMode (uMode=0x0) returned 0x1 [0112.413] GetFileType (hFile=0x3f4) returned 0x1 [0112.413] WriteFile (in: hFile=0x3f4, lpBuffer=0x2ac56e0*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe968, lpOverlapped=0x0 | out: lpBuffer=0x2ac56e0*, lpNumberOfBytesWritten=0x8fe968*=0xbcb, lpOverlapped=0x0) returned 1 [0112.415] GetLastError () returned 0x0 [0112.415] CloseHandle (hObject=0x3f4) returned 1 [0112.416] GetLastError () returned 0x0 [0112.416] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Sideload", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Sideload", lpFilePart=0x0) returned 0x2f [0112.416] GetLastError () returned 0x0 [0112.416] SetErrorMode (uMode=0x1) returned 0x0 [0112.416] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Sideload\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a06c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f66e0 [0112.416] GetLastError () returned 0x0 [0112.416] FindNextFileW (in: hFindFile=0x9f66e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a06c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.416] GetLastError () returned 0x0 [0112.416] FindNextFileW (in: hFindFile=0x9f66e0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a06c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0112.416] GetLastError () returned 0x12 [0112.416] FindClose (in: hFindFile=0x9f66e0 | out: hFindFile=0x9f66e0) returned 1 [0112.416] SetErrorMode (uMode=0x0) returned 0x1 [0112.416] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Sideload", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Sideload", lpFilePart=0x0) returned 0x2f [0112.417] GetLastError () returned 0x12 [0112.417] SetErrorMode (uMode=0x1) returned 0x0 [0112.417] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Sideload\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a06c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f6560 [0112.417] GetLastError () returned 0x12 [0112.417] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a06c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.417] GetLastError () returned 0x12 [0112.417] FindNextFileW (in: hFindFile=0x9f6560, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a06c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0112.417] GetLastError () returned 0x12 [0112.417] FindClose (in: hFindFile=0x9f6560 | out: hFindFile=0x9f6560) returned 1 [0112.417] SetErrorMode (uMode=0x0) returned 0x1 [0112.417] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Sideload\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Sideload\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x42 [0112.417] GetLastError () returned 0x12 [0112.417] SetErrorMode (uMode=0x1) returned 0x0 [0112.417] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Sideload\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\sideload\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3f4 [0112.418] GetLastError () returned 0x0 [0112.418] GetFileType (hFile=0x3f4) returned 0x1 [0112.418] SetErrorMode (uMode=0x0) returned 0x1 [0112.418] GetFileType (hFile=0x3f4) returned 0x1 [0112.418] WriteFile (in: hFile=0x3f4, lpBuffer=0x2accf0c*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe968, lpOverlapped=0x0 | out: lpBuffer=0x2accf0c*, lpNumberOfBytesWritten=0x8fe968*=0xbcb, lpOverlapped=0x0) returned 1 [0112.419] GetLastError () returned 0x0 [0112.419] CloseHandle (hObject=0x3f4) returned 1 [0112.420] GetLastError () returned 0x0 [0112.420] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Siufloc", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Siufloc", lpFilePart=0x0) returned 0x2e [0112.420] GetLastError () returned 0x0 [0112.420] SetErrorMode (uMode=0x1) returned 0x0 [0112.420] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Siufloc\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a0bca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f66a0 [0112.420] GetLastError () returned 0x0 [0112.420] FindNextFileW (in: hFindFile=0x9f66a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a0bca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.420] GetLastError () returned 0x0 [0112.420] FindNextFileW (in: hFindFile=0x9f66a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a0bca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0112.420] GetLastError () returned 0x12 [0112.420] FindClose (in: hFindFile=0x9f66a0 | out: hFindFile=0x9f66a0) returned 1 [0112.420] SetErrorMode (uMode=0x0) returned 0x1 [0112.420] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Siufloc", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Siufloc", lpFilePart=0x0) returned 0x2e [0112.421] GetLastError () returned 0x12 [0112.421] SetErrorMode (uMode=0x1) returned 0x0 [0112.421] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Siufloc\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a0bca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f66a0 [0112.421] GetLastError () returned 0x12 [0112.421] FindNextFileW (in: hFindFile=0x9f66a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a0bca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.421] GetLastError () returned 0x12 [0112.421] FindNextFileW (in: hFindFile=0x9f66a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a0bca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0112.421] GetLastError () returned 0x12 [0112.421] FindClose (in: hFindFile=0x9f66a0 | out: hFindFile=0x9f66a0) returned 1 [0112.421] SetErrorMode (uMode=0x0) returned 0x1 [0112.421] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Siufloc\\README-BW-gffL.txt", nBufferLength=0x105, lpBuffer=0x8fe410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Siufloc\\README-BW-gffL.txt", lpFilePart=0x0) returned 0x41 [0112.421] GetLastError () returned 0x12 [0112.421] SetErrorMode (uMode=0x1) returned 0x0 [0112.421] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Siufloc\\README-BW-gffL.txt" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\siufloc\\readme-bw-gffl.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3f4 [0112.422] GetLastError () returned 0x0 [0112.422] GetFileType (hFile=0x3f4) returned 0x1 [0112.422] SetErrorMode (uMode=0x0) returned 0x1 [0112.422] GetFileType (hFile=0x3f4) returned 0x1 [0112.422] WriteFile (in: hFile=0x3f4, lpBuffer=0x2ad4734*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x8fe968, lpOverlapped=0x0 | out: lpBuffer=0x2ad4734*, lpNumberOfBytesWritten=0x8fe968*=0xbcb, lpOverlapped=0x0) returned 1 [0112.423] GetLastError () returned 0x0 [0112.423] CloseHandle (hObject=0x3f4) returned 1 [0112.427] GetLastError () returned 0x0 [0112.427] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding", nBufferLength=0x105, lpBuffer=0x8fe4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding", lpFilePart=0x0) returned 0x32 [0112.427] GetLastError () returned 0x0 [0112.427] SetErrorMode (uMode=0x1) returned 0x0 [0112.427] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\*", lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4ddac897, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4e4cb173, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9f65a0 [0112.433] GetLastError () returned 0x0 [0112.433] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4ddac897, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4e4cb173, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.434] GetLastError () returned 0x0 [0112.434] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bfa790, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4de62c84, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x840fae4f, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x41c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml", cAlternateFileName="03D1E1~1.XML")) returned 1 [0112.434] GetLastError () returned 0x0 [0112.434] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c20a14, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4defb5dd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x840fae4f, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x441b, dwReserved0=0x0, dwReserved1=0x0, cFileName="03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml", cAlternateFileName="03D1E1~2.XML")) returned 1 [0112.434] GetLastError () returned 0x0 [0112.434] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7750111, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4df6de00, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb8128f6c, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4180, dwReserved0=0x0, dwReserved1=0x0, cFileName="394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml", cAlternateFileName="394B7B~1.XML")) returned 1 [0112.434] GetLastError () returned 0x0 [0112.435] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7750111, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e006640, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb5c02e23, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4187, dwReserved0=0x0, dwReserved1=0x0, cFileName="394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml", cAlternateFileName="394B7B~2.XML")) returned 1 [0112.435] GetLastError () returned 0x0 [0112.435] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c46c2e, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4e09efaa, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x8625bd94, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x0, dwReserved1=0x0, cFileName="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml", cAlternateFileName="75EF5B~1.XML")) returned 1 [0112.435] GetLastError () returned 0x0 [0112.435] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c46c2e, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4e0c51fa, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x86556ca1, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x4473, dwReserved0=0x0, dwReserved1=0x0, cFileName="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml", cAlternateFileName="75EF5B~2.XML")) returned 1 [0112.435] GetLastError () returned 0x0 [0112.435] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7776347, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e15dbbf, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbbc2bb3b, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x418e, dwReserved0=0x0, dwReserved1=0x0, cFileName="9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml", cAlternateFileName="9984EC~1.XML")) returned 1 [0112.435] GetLastError () returned 0x0 [0112.435] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7776347, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e1f64ee, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbbb6d045, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x418c, dwReserved0=0x0, dwReserved1=0x0, cFileName="9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml", cAlternateFileName="9984EC~2.XML")) returned 1 [0112.435] GetLastError () returned 0x0 [0112.435] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc779c570, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e24298b, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb9eacc8c, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x433c, dwReserved0=0x0, dwReserved1=0x0, cFileName="acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml", cAlternateFileName="ACAE42~1.XML")) returned 1 [0112.435] GetLastError () returned 0x0 [0112.436] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc779c570, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e28ee3c, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xba09c6cc, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x443f, dwReserved0=0x0, dwReserved1=0x0, cFileName="acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml", cAlternateFileName="ACAE42~2.XML")) returned 1 [0112.436] GetLastError () returned 0x0 [0112.436] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc779c570, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e2b5071, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb8d3a091, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x442d, dwReserved0=0x0, dwReserved1=0x0, cFileName="c0802597-6174-487a-b7de-20e8b1aa384e_show.xml", cAlternateFileName="C08025~1.XML")) returned 1 [0112.436] GetLastError () returned 0x0 [0112.436] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc77c27a6, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e2db2dd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb8c553ea, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4187, dwReserved0=0x0, dwReserved1=0x0, cFileName="c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml", cAlternateFileName="C08025~2.XML")) returned 1 [0112.436] GetLastError () returned 0x0 [0112.436] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc77c27a6, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e301522, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbb0b32d3, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x418b, dwReserved0=0x0, dwReserved1=0x0, cFileName="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml", cAlternateFileName="E80C85~1.XML")) returned 1 [0112.436] GetLastError () returned 0x0 [0112.436] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc77e89d5, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e34d9d0, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbaf35d10, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4172, dwReserved0=0x0, dwReserved1=0x0, cFileName="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml", cAlternateFileName="E80C85~2.XML")) returned 1 [0112.436] GetLastError () returned 0x0 [0112.436] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c930e8, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4e399e7e, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x8507a310, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x5c3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="e9d21752-8fc9-4793-b42e-33105b078a51_show.xml", cAlternateFileName="E9D217~1.XML")) returned 1 [0112.436] GetLastError () returned 0x0 [0112.436] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c930e8, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4e458a8d, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x85007c03, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x424c, dwReserved0=0x0, dwReserved1=0x0, cFileName="e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml", cAlternateFileName="E9D217~2.XML")) returned 1 [0112.436] GetLastError () returned 0x0 [0112.437] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc780ec0e, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e4a4f18, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb806a476, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x43ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="fffd8b5d-0172-4719-a792-b7c76986459d_show.xml", cAlternateFileName="FFFD8B~1.XML")) returned 1 [0112.437] GetLastError () returned 0x0 [0112.437] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc780ec0e, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e4cb173, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb819b5fa, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4443, dwReserved0=0x0, dwReserved1=0x0, cFileName="fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml", cAlternateFileName="FFFD8B~2.XML")) returned 1 [0112.437] GetLastError () returned 0x0 [0112.437] FindNextFileW (in: hFindFile=0x9f65a0, lpFindFileData=0xa21e98 | out: lpFindFileData=0xa21e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc780ec0e, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e4cb173, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb819b5fa, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4443, dwReserved0=0x0, dwReserved1=0x0, cFileName="fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml", cAlternateFileName="FFFD8B~2.XML")) returned 0 [0112.437] GetLastError () returned 0x12 [0112.437] FindClose (in: hFindFile=0x9f65a0 | out: hFindFile=0x9f65a0) returned 1 [0112.438] SetErrorMode (uMode=0x0) returned 0x1 [0112.438] GetProcessWindowStation () returned 0x13c [0112.438] GetActiveWindow () returned 0x7002e [0112.438] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0112.438] GetCurrentThreadId () returned 0x540 [0112.438] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4d4a, lParam=0x0) returned 1 [0112.438] IsWindowVisible (hWnd=0x7002e) returned 0 [0112.439] IsWindowVisible (hWnd=0x4020e) returned 0 [0112.439] IsWindowVisible (hWnd=0x60044) returned 0 [0112.439] IsWindowVisible (hWnd=0x2021a) returned 0 [0112.439] IsWindowVisible (hWnd=0x8004a) returned 0 [0112.439] GetActiveWindow () returned 0x7002e [0112.439] GetFocus () returned 0x7002e [0112.439] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0112.440] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0112.441] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0112.441] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0112.442] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0112.442] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0112.442] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0112.450] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x95020c) returned 0x1 [0112.451] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0112.451] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0112.557] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0112.564] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0112.564] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0112.564] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x95020c) returned 0x1 [0112.566] SetFocus (hWnd=0x7002e) returned 0x95020c [0112.568] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0112.569] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0112.569] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0112.572] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0112.572] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x95020c, lParam=0x0) returned 0x0 [0112.577] IsWindow (hWnd=0x7002e) returned 1 [0112.577] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0112.577] IsWindow (hWnd=0x7002e) returned 1 [0112.577] SetFocus (hWnd=0x7002e) returned 0x7002e [0112.577] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0112.577] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0112.577] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0112.577] GetProcessWindowStation () returned 0x13c [0112.577] GetActiveWindow () returned 0x7002e [0112.577] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0112.578] GetCurrentThreadId () returned 0x540 [0112.578] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c49ea, lParam=0x0) returned 1 [0112.578] IsWindowVisible (hWnd=0x7002e) returned 0 [0112.578] IsWindowVisible (hWnd=0x4020e) returned 0 [0112.578] IsWindowVisible (hWnd=0x60044) returned 0 [0112.578] IsWindowVisible (hWnd=0x2021a) returned 0 [0112.578] IsWindowVisible (hWnd=0x8004a) returned 0 [0112.578] GetActiveWindow () returned 0x7002e [0112.578] GetFocus () returned 0x7002e [0112.578] MessageBoxW (hWnd=0x7002e, lpText="D5gX1lTyb7iPR4olrxBARg==", lpCaption="", uType=0x0) returned 1 [0112.579] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0112.580] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0112.580] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0112.581] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0112.581] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0112.581] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0112.589] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x96020c) returned 0x1 [0112.590] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0112.590] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0112.777] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0112.784] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0112.784] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0112.784] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x96020c) returned 0x1 [0112.785] SetFocus (hWnd=0x7002e) returned 0x96020c [0112.787] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0112.790] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0112.790] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0112.791] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0112.791] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x96020c, lParam=0x0) returned 0x0 [0112.795] IsWindow (hWnd=0x7002e) returned 1 [0112.795] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0112.795] IsWindow (hWnd=0x7002e) returned 1 [0112.795] SetFocus (hWnd=0x7002e) returned 0x7002e [0112.795] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0112.795] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0112.795] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0112.795] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml", nBufferLength=0x105, lpBuffer=0x8fe520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml", lpFilePart=0x0) returned 0x60 [0112.795] GetLastError () returned 0x0 [0112.795] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml", dwFileAttributes=0x80) returned 0 [0112.797] GetLastError () returned 0x5 [0112.800] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml", nBufferLength=0x105, lpBuffer=0x8fe3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml", lpFilePart=0x0) returned 0x60 [0112.800] GetLastError () returned 0x5 [0112.800] SetErrorMode (uMode=0x1) returned 0x0 [0112.800] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0112.801] GetLastError () returned 0x5 [0112.803] SetErrorMode (uMode=0x0) returned 0x1 [0112.807] GetProcessWindowStation () returned 0x13c [0112.807] GetActiveWindow () returned 0x7002e [0112.807] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0112.807] GetCurrentThreadId () returned 0x540 [0112.807] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4daa, lParam=0x0) returned 1 [0112.807] IsWindowVisible (hWnd=0x7002e) returned 0 [0112.807] IsWindowVisible (hWnd=0x4020e) returned 0 [0112.807] IsWindowVisible (hWnd=0x60044) returned 0 [0112.807] IsWindowVisible (hWnd=0x2021a) returned 0 [0112.807] IsWindowVisible (hWnd=0x8004a) returned 0 [0112.807] GetActiveWindow () returned 0x7002e [0112.807] GetFocus () returned 0x7002e [0112.807] MessageBoxW (hWnd=0x7002e, lpText="System.Byte[]", lpCaption="", uType=0x0) returned 1 [0112.808] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0112.809] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0112.809] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0112.810] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0112.810] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0112.810] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0112.816] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x97020c) returned 0x1 [0112.817] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0112.817] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0112.967] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0112.974] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0112.974] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fdfe4) returned 0x0 [0112.974] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x1, lParam=0x97020c) returned 0x1 [0112.975] SetFocus (hWnd=0x7002e) returned 0x97020c [0112.977] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0112.978] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0112.978] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0112.979] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0112.979] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x97020c, lParam=0x0) returned 0x0 [0112.983] IsWindow (hWnd=0x7002e) returned 1 [0112.983] SetActiveWindow (hWnd=0x7002e) returned 0x7002e [0112.983] IsWindow (hWnd=0x7002e) returned 1 [0112.983] SetFocus (hWnd=0x7002e) returned 0x7002e [0112.983] SendMessageW (hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0112.983] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0112.983] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0112.984] GetProcessWindowStation () returned 0x13c [0112.984] GetActiveWindow () returned 0x7002e [0112.984] GetCurrentActCtx (in: lphActCtx=0x8fe924 | out: lphActCtx=0x8fe924*=0x9f8cbc) returned 1 [0112.984] GetCurrentThreadId () returned 0x540 [0112.984] EnumThreadWindows (dwThreadId=0x540, lpfn=0x25c4a7a, lParam=0x0) returned 1 [0112.984] IsWindowVisible (hWnd=0x7002e) returned 0 [0112.984] IsWindowVisible (hWnd=0x4020e) returned 0 [0112.984] IsWindowVisible (hWnd=0x60044) returned 0 [0112.984] IsWindowVisible (hWnd=0x2021a) returned 0 [0112.984] IsWindowVisible (hWnd=0x8004a) returned 0 [0112.984] GetActiveWindow () returned 0x7002e [0112.985] GetFocus () returned 0x7002e [0112.985] MessageBoxW (hWnd=0x7002e, lpText="1/eBaOgEeczJ9mjd/ctEWw==", lpCaption="", uType=0x0) [0112.985] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0112.986] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0112.986] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0112.987] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0112.987] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0112.987] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0112.996] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x86, wParam=0x0, lParam=0x98020c) returned 0x1 [0112.997] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0112.997] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe1dc) returned 0x0 [0116.193] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe514) returned 0x0 [0116.193] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe514) returned 0x0 [0116.201] GetWindowPlacement (in: hWnd=0x7002e, lpwndpl=0x8fe250 | out: lpwndpl=0x8fe250) returned 1 [0116.201] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x47, wParam=0x0, lParam=0x8fe514) returned 0x0 [0116.201] GetClientRect (in: hWnd=0x7002e, lpRect=0x8fe1ec | out: lpRect=0x8fe1ec) returned 1 [0116.202] GetWindowRect (in: hWnd=0x7002e, lpRect=0x8fe1ec | out: lpRect=0x8fe1ec) returned 1 [0116.202] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x47, wParam=0x0, lParam=0x8fe514) returned 0x0 [0116.206] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x1c, wParam=0x0, lParam=0xc04) returned 0x0 [0116.206] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1c, wParam=0x0, lParam=0xc04) returned 0x0 [0116.206] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x1c, wParam=0x0, lParam=0xc04) returned 0x0 [0131.299] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0131.346] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe514) returned 0x0 [0131.346] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe514) returned 0x0 [0131.354] GetWindowPlacement (in: hWnd=0x7002e, lpwndpl=0x8fe250 | out: lpwndpl=0x8fe250) returned 1 [0131.354] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x47, wParam=0x0, lParam=0x8fe514) returned 0x0 [0131.354] GetClientRect (in: hWnd=0x7002e, lpRect=0x8fe1ec | out: lpRect=0x8fe1ec) returned 1 [0131.354] GetWindowRect (in: hWnd=0x7002e, lpRect=0x8fe1ec | out: lpRect=0x8fe1ec) returned 1 [0131.355] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x47, wParam=0x0, lParam=0x8fe514) returned 0x0 [0131.355] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1c, wParam=0x1, lParam=0x6cc) returned 0x0 [0131.355] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x1c, wParam=0x1, lParam=0x6cc) returned 0x0 [0131.355] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x1c, wParam=0x1, lParam=0x6cc) returned 0x0 [0131.404] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0131.405] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0136.474] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe514) returned 0x0 [0136.474] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe514) returned 0x0 [0136.479] GetWindowPlacement (in: hWnd=0x7002e, lpwndpl=0x8fe250 | out: lpwndpl=0x8fe250) returned 1 [0136.480] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x47, wParam=0x0, lParam=0x8fe514) returned 0x0 [0136.480] GetClientRect (in: hWnd=0x7002e, lpRect=0x8fe1ec | out: lpRect=0x8fe1ec) returned 1 [0136.480] GetWindowRect (in: hWnd=0x7002e, lpRect=0x8fe1ec | out: lpRect=0x8fe1ec) returned 1 [0136.480] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x47, wParam=0x0, lParam=0x8fe514) returned 0x0 [0136.485] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x1c, wParam=0x0, lParam=0xc04) returned 0x0 [0136.486] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1c, wParam=0x0, lParam=0xc04) returned 0x0 [0136.486] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x1c, wParam=0x0, lParam=0xc04) returned 0x0 [0151.785] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe514) returned 0x0 [0151.785] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe514) returned 0x0 [0151.800] GetWindowPlacement (in: hWnd=0x7002e, lpwndpl=0x8fe250 | out: lpwndpl=0x8fe250) returned 1 [0151.801] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x47, wParam=0x0, lParam=0x8fe514) returned 0x0 [0151.802] GetClientRect (in: hWnd=0x7002e, lpRect=0x8fe1ec | out: lpRect=0x8fe1ec) returned 1 [0151.802] GetWindowRect (in: hWnd=0x7002e, lpRect=0x8fe1ec | out: lpRect=0x8fe1ec) returned 1 [0151.802] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x47, wParam=0x0, lParam=0x8fe514) returned 0x0 [0151.806] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1c, wParam=0x1, lParam=0x6cc) returned 0x0 [0151.806] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x1c, wParam=0x1, lParam=0x6cc) returned 0x0 [0151.806] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x1c, wParam=0x1, lParam=0x6cc) returned 0x0 [0156.968] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe514) returned 0x0 [0156.968] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe514) returned 0x0 [0156.970] GetWindowPlacement (in: hWnd=0x7002e, lpwndpl=0x8fe250 | out: lpwndpl=0x8fe250) returned 1 [0156.971] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x47, wParam=0x0, lParam=0x8fe514) returned 0x0 [0156.971] GetClientRect (in: hWnd=0x7002e, lpRect=0x8fe1ec | out: lpRect=0x8fe1ec) returned 1 [0156.971] GetWindowRect (in: hWnd=0x7002e, lpRect=0x8fe1ec | out: lpRect=0x8fe1ec) returned 1 [0156.971] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x47, wParam=0x0, lParam=0x8fe514) returned 0x0 [0156.980] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x1c, wParam=0x0, lParam=0xc04) returned 0x0 [0156.980] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1c, wParam=0x0, lParam=0xc04) returned 0x0 [0156.980] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x1c, wParam=0x0, lParam=0xc04) returned 0x0 [0172.255] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe514) returned 0x0 [0172.255] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe514) returned 0x0 [0172.259] GetWindowPlacement (in: hWnd=0x7002e, lpwndpl=0x8fe250 | out: lpwndpl=0x8fe250) returned 1 [0172.259] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x47, wParam=0x0, lParam=0x8fe514) returned 0x0 [0172.260] GetClientRect (in: hWnd=0x7002e, lpRect=0x8fe1ec | out: lpRect=0x8fe1ec) returned 1 [0172.260] GetWindowRect (in: hWnd=0x7002e, lpRect=0x8fe1ec | out: lpRect=0x8fe1ec) returned 1 [0172.260] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x47, wParam=0x0, lParam=0x8fe514) returned 0x0 [0172.261] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1c, wParam=0x1, lParam=0x6cc) returned 0x0 [0172.261] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x1c, wParam=0x1, lParam=0x6cc) returned 0x0 [0172.261] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x1c, wParam=0x1, lParam=0x6cc) returned 0x0 [0177.358] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe514) returned 0x0 [0177.358] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe514) returned 0x0 [0177.361] GetWindowPlacement (in: hWnd=0x7002e, lpwndpl=0x8fe250 | out: lpwndpl=0x8fe250) returned 1 [0177.361] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x47, wParam=0x0, lParam=0x8fe514) returned 0x0 [0177.361] GetClientRect (in: hWnd=0x7002e, lpRect=0x8fe1ec | out: lpRect=0x8fe1ec) returned 1 [0177.361] GetWindowRect (in: hWnd=0x7002e, lpRect=0x8fe1ec | out: lpRect=0x8fe1ec) returned 1 [0177.361] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x47, wParam=0x0, lParam=0x8fe514) returned 0x0 [0177.370] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x1c, wParam=0x0, lParam=0xc04) returned 0x0 [0177.371] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1c, wParam=0x0, lParam=0xc04) returned 0x0 [0177.371] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x1c, wParam=0x0, lParam=0xc04) returned 0x0 [0192.633] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe514) returned 0x0 [0192.633] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe514) returned 0x0 [0192.637] GetWindowPlacement (in: hWnd=0x7002e, lpwndpl=0x8fe250 | out: lpwndpl=0x8fe250) returned 1 [0192.637] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x47, wParam=0x0, lParam=0x8fe514) returned 0x0 [0192.637] GetClientRect (in: hWnd=0x7002e, lpRect=0x8fe1ec | out: lpRect=0x8fe1ec) returned 1 [0192.637] GetWindowRect (in: hWnd=0x7002e, lpRect=0x8fe1ec | out: lpRect=0x8fe1ec) returned 1 [0192.638] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x47, wParam=0x0, lParam=0x8fe514) returned 0x0 [0192.639] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1c, wParam=0x1, lParam=0x6cc) returned 0x0 [0192.639] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x1c, wParam=0x1, lParam=0x6cc) returned 0x0 [0192.639] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x1c, wParam=0x1, lParam=0x6cc) returned 0x0 [0197.775] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe514) returned 0x0 [0197.775] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe514) returned 0x0 [0197.780] GetWindowPlacement (in: hWnd=0x7002e, lpwndpl=0x8fe250 | out: lpwndpl=0x8fe250) returned 1 [0197.780] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x47, wParam=0x0, lParam=0x8fe514) returned 0x0 [0197.780] GetClientRect (in: hWnd=0x7002e, lpRect=0x8fe1ec | out: lpRect=0x8fe1ec) returned 1 [0197.780] GetWindowRect (in: hWnd=0x7002e, lpRect=0x8fe1ec | out: lpRect=0x8fe1ec) returned 1 [0197.780] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x47, wParam=0x0, lParam=0x8fe514) returned 0x0 [0197.784] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x1c, wParam=0x0, lParam=0xc04) returned 0x0 [0197.785] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1c, wParam=0x0, lParam=0xc04) returned 0x0 [0197.785] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x1c, wParam=0x0, lParam=0xc04) returned 0x0 [0213.250] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe514) returned 0x0 [0213.251] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe514) returned 0x0 [0213.253] GetWindowPlacement (in: hWnd=0x7002e, lpwndpl=0x8fe250 | out: lpwndpl=0x8fe250) returned 1 [0213.254] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x47, wParam=0x0, lParam=0x8fe514) returned 0x0 [0213.254] GetClientRect (in: hWnd=0x7002e, lpRect=0x8fe1ec | out: lpRect=0x8fe1ec) returned 1 [0213.254] GetWindowRect (in: hWnd=0x7002e, lpRect=0x8fe1ec | out: lpRect=0x8fe1ec) returned 1 [0213.254] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x47, wParam=0x0, lParam=0x8fe514) returned 0x0 [0213.255] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1c, wParam=0x1, lParam=0x6cc) returned 0x0 [0213.255] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x1c, wParam=0x1, lParam=0x6cc) returned 0x0 [0213.255] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x1c, wParam=0x1, lParam=0x6cc) returned 0x0 [0218.395] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe514) returned 0x0 [0218.396] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe514) returned 0x0 [0218.401] GetWindowPlacement (in: hWnd=0x7002e, lpwndpl=0x8fe250 | out: lpwndpl=0x8fe250) returned 1 [0218.401] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x47, wParam=0x0, lParam=0x8fe514) returned 0x0 [0218.401] GetClientRect (in: hWnd=0x7002e, lpRect=0x8fe1ec | out: lpRect=0x8fe1ec) returned 1 [0218.401] GetWindowRect (in: hWnd=0x7002e, lpRect=0x8fe1ec | out: lpRect=0x8fe1ec) returned 1 [0218.402] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x47, wParam=0x0, lParam=0x8fe514) returned 0x0 [0218.405] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x1c, wParam=0x0, lParam=0xc04) returned 0x0 [0218.406] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1c, wParam=0x0, lParam=0xc04) returned 0x0 [0218.406] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x1c, wParam=0x0, lParam=0xc04) returned 0x0 [0233.938] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe514) returned 0x0 [0233.938] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe514) returned 0x0 [0233.944] GetWindowPlacement (in: hWnd=0x7002e, lpwndpl=0x8fe250 | out: lpwndpl=0x8fe250) returned 1 [0233.945] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x47, wParam=0x0, lParam=0x8fe514) returned 0x0 [0233.945] GetClientRect (in: hWnd=0x7002e, lpRect=0x8fe1ec | out: lpRect=0x8fe1ec) returned 1 [0233.945] GetWindowRect (in: hWnd=0x7002e, lpRect=0x8fe1ec | out: lpRect=0x8fe1ec) returned 1 [0233.945] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x47, wParam=0x0, lParam=0x8fe514) returned 0x0 [0233.946] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1c, wParam=0x1, lParam=0x6cc) returned 0x0 [0233.946] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x1c, wParam=0x1, lParam=0x6cc) returned 0x0 [0233.946] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x1c, wParam=0x1, lParam=0x6cc) returned 0x0 [0239.177] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe514) returned 0x0 [0239.177] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe514) returned 0x0 [0239.211] GetWindowPlacement (in: hWnd=0x7002e, lpwndpl=0x8fe250 | out: lpwndpl=0x8fe250) returned 1 [0239.212] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x47, wParam=0x0, lParam=0x8fe514) returned 0x0 [0239.212] GetClientRect (in: hWnd=0x7002e, lpRect=0x8fe1ec | out: lpRect=0x8fe1ec) returned 1 [0239.212] GetWindowRect (in: hWnd=0x7002e, lpRect=0x8fe1ec | out: lpRect=0x8fe1ec) returned 1 [0239.212] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x47, wParam=0x0, lParam=0x8fe514) returned 0x0 [0239.219] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x1c, wParam=0x0, lParam=0xc04) returned 0x0 [0239.219] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1c, wParam=0x0, lParam=0xc04) returned 0x0 [0239.219] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x1c, wParam=0x0, lParam=0xc04) returned 0x0 [0254.908] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe514) returned 0x0 [0254.908] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe514) returned 0x0 [0254.912] GetWindowPlacement (in: hWnd=0x7002e, lpwndpl=0x8fe250 | out: lpwndpl=0x8fe250) returned 1 [0254.912] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x47, wParam=0x0, lParam=0x8fe514) returned 0x0 [0254.912] GetClientRect (in: hWnd=0x7002e, lpRect=0x8fe1ec | out: lpRect=0x8fe1ec) returned 1 [0254.922] GetWindowRect (in: hWnd=0x7002e, lpRect=0x8fe1ec | out: lpRect=0x8fe1ec) returned 1 [0254.923] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x47, wParam=0x0, lParam=0x8fe514) returned 0x0 [0254.923] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1c, wParam=0x1, lParam=0x6cc) returned 0x0 [0254.923] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x1c, wParam=0x1, lParam=0x6cc) returned 0x0 [0254.924] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x1c, wParam=0x1, lParam=0x6cc) returned 0x0 [0260.190] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe514) returned 0x0 [0260.191] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe514) returned 0x0 [0260.211] GetWindowPlacement (in: hWnd=0x7002e, lpwndpl=0x8fe250 | out: lpwndpl=0x8fe250) returned 1 [0260.211] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x47, wParam=0x0, lParam=0x8fe514) returned 0x0 [0260.211] GetClientRect (in: hWnd=0x7002e, lpRect=0x8fe1ec | out: lpRect=0x8fe1ec) returned 1 [0260.211] GetWindowRect (in: hWnd=0x7002e, lpRect=0x8fe1ec | out: lpRect=0x8fe1ec) returned 1 [0260.212] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x47, wParam=0x0, lParam=0x8fe514) returned 0x0 [0260.216] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x1c, wParam=0x0, lParam=0xc04) returned 0x0 [0260.216] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1c, wParam=0x0, lParam=0xc04) returned 0x0 [0260.216] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x1c, wParam=0x0, lParam=0xc04) returned 0x0 [0275.835] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe514) returned 0x0 [0275.835] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe514) returned 0x0 [0275.838] GetWindowPlacement (in: hWnd=0x7002e, lpwndpl=0x8fe250 | out: lpwndpl=0x8fe250) returned 1 [0275.838] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x47, wParam=0x0, lParam=0x8fe514) returned 0x0 [0275.838] GetClientRect (in: hWnd=0x7002e, lpRect=0x8fe1ec | out: lpRect=0x8fe1ec) returned 1 [0275.838] GetWindowRect (in: hWnd=0x7002e, lpRect=0x8fe1ec | out: lpRect=0x8fe1ec) returned 1 [0275.839] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x47, wParam=0x0, lParam=0x8fe514) returned 0x0 [0275.840] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1c, wParam=0x1, lParam=0x6cc) returned 0x0 [0275.840] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x1c, wParam=0x1, lParam=0x6cc) returned 0x0 [0275.840] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x1c, wParam=0x1, lParam=0x6cc) returned 0x0 [0281.046] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe514) returned 0x0 [0281.047] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x46, wParam=0x0, lParam=0x8fe514) returned 0x0 [0281.049] GetWindowPlacement (in: hWnd=0x7002e, lpwndpl=0x8fe250 | out: lpwndpl=0x8fe250) returned 1 [0281.050] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x47, wParam=0x0, lParam=0x8fe514) returned 0x0 [0281.050] GetClientRect (in: hWnd=0x7002e, lpRect=0x8fe1ec | out: lpRect=0x8fe1ec) returned 1 [0281.050] GetWindowRect (in: hWnd=0x7002e, lpRect=0x8fe1ec | out: lpRect=0x8fe1ec) returned 1 [0281.050] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x47, wParam=0x0, lParam=0x8fe514) returned 0x0 [0281.062] NtdllDefWindowProc_W (hWnd=0x60044, Msg=0x1c, wParam=0x0, lParam=0xc04) returned 0x0 [0281.062] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x7002e, Msg=0x1c, wParam=0x0, lParam=0xc04) returned 0x0 [0281.062] CallWindowProcW (lpPrevWndFunc=0x77c35690, hWnd=0x4020e, Msg=0x1c, wParam=0x0, lParam=0xc04) returned 0x0 Thread: id = 2 os_tid = 0xef4 Thread: id = 3 os_tid = 0xf88 Thread: id = 4 os_tid = 0x4ac [0038.968] CoGetContextToken (in: pToken=0x4b4f638 | out: pToken=0x4b4f638) returned 0x800401f0 [0038.968] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0053.745] CryptDestroyKey (hKey=0x9f60a0) returned 1 [0053.745] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0053.745] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0053.746] CryptDestroyKey (hKey=0x9f60e0) returned 1 [0053.746] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0053.746] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0053.746] CryptDestroyKey (hKey=0x9f6660) returned 1 [0053.746] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0053.746] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0053.746] CryptDestroyKey (hKey=0x9f6220) returned 1 [0053.746] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0053.746] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0053.746] CryptDestroyKey (hKey=0x9f62e0) returned 1 [0053.747] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0053.747] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0053.747] CryptDestroyKey (hKey=0x9f65a0) returned 1 [0053.747] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0053.747] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0053.747] CryptDestroyKey (hKey=0x9f63a0) returned 1 [0053.747] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0053.747] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0053.748] CryptDestroyKey (hKey=0x9f67e0) returned 1 [0053.748] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0053.748] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0053.748] CryptDestroyKey (hKey=0x9f66e0) returned 1 [0053.748] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0053.748] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0053.748] CryptDestroyKey (hKey=0x9f5ba0) returned 1 [0053.748] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0053.748] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0053.748] CryptDestroyKey (hKey=0x9f6560) returned 1 [0053.748] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0053.749] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0055.697] CryptDestroyKey (hKey=0x9f65e0) returned 1 [0055.697] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0055.697] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0055.698] CryptDestroyKey (hKey=0x9f5860) returned 1 [0055.698] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0055.698] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0064.469] CryptDestroyKey (hKey=0x9f60a0) returned 1 [0064.469] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0064.469] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0064.469] CryptDestroyKey (hKey=0x9f6560) returned 1 [0064.469] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0064.469] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0064.469] CryptDestroyKey (hKey=0x9f5860) returned 1 [0064.469] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0064.469] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0064.470] CryptDestroyKey (hKey=0x9f5ba0) returned 1 [0064.470] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0064.470] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0068.643] CryptDestroyKey (hKey=0x9f66e0) returned 1 [0068.643] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0068.643] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0068.643] CryptDestroyKey (hKey=0x9f65a0) returned 1 [0068.643] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0068.643] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0068.644] CryptDestroyKey (hKey=0x9f5ba0) returned 1 [0068.644] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0068.644] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0068.644] CryptDestroyKey (hKey=0x9f6760) returned 1 [0068.644] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0068.644] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0068.645] CryptDestroyKey (hKey=0x9f5860) returned 1 [0068.645] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0068.645] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0068.645] CryptDestroyKey (hKey=0x9f6720) returned 1 [0068.645] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0068.645] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0089.563] CryptDestroyKey (hKey=0x9f61a0) returned 1 [0089.563] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0089.564] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0089.564] CryptDestroyKey (hKey=0x9f67a0) returned 1 [0089.564] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0089.564] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0089.564] CryptDestroyKey (hKey=0x9f6620) returned 1 [0089.564] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0089.564] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0089.565] CryptDestroyKey (hKey=0x9f6720) returned 1 [0089.565] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0089.565] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0089.565] CryptDestroyKey (hKey=0x9f65a0) returned 1 [0089.565] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0089.565] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0089.566] CryptDestroyKey (hKey=0x9f6760) returned 1 [0089.566] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0089.566] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0089.566] CryptDestroyKey (hKey=0x9f66a0) returned 1 [0089.566] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0089.566] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0089.566] CryptDestroyKey (hKey=0x9f60e0) returned 1 [0089.566] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0089.566] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0089.566] CryptDestroyKey (hKey=0x9f6560) returned 1 [0089.566] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0089.566] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0089.567] CryptDestroyKey (hKey=0x9f62e0) returned 1 [0089.567] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0089.567] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0089.567] CryptDestroyKey (hKey=0x9f6660) returned 1 [0089.567] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0089.567] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0089.567] CryptDestroyKey (hKey=0x9f6120) returned 1 [0089.567] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0089.567] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0089.568] CryptDestroyKey (hKey=0x9f6260) returned 1 [0089.568] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0089.568] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0089.568] CryptDestroyKey (hKey=0x9f60a0) returned 1 [0089.568] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0089.568] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0089.569] CryptDestroyKey (hKey=0x9f6220) returned 1 [0089.569] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0089.569] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0089.569] CryptDestroyKey (hKey=0x9f61e0) returned 1 [0089.569] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0089.569] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0089.569] CryptDestroyKey (hKey=0x9f66e0) returned 1 [0089.569] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0089.570] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0089.570] CryptDestroyKey (hKey=0x9f63a0) returned 1 [0089.570] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0089.570] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0089.570] CryptDestroyKey (hKey=0x9f65e0) returned 1 [0089.570] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0089.570] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0102.924] CryptDestroyKey (hKey=0x9f67e0) returned 1 [0102.924] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0102.924] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0102.924] CryptDestroyKey (hKey=0x9f65e0) returned 1 [0102.924] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0102.924] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0102.925] CryptDestroyKey (hKey=0x9f6060) returned 1 [0102.925] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0102.925] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0102.925] CryptDestroyKey (hKey=0x9f66a0) returned 1 [0102.925] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0102.925] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0102.925] CryptDestroyKey (hKey=0x9f66e0) returned 1 [0102.925] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0102.925] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0102.925] CryptDestroyKey (hKey=0x9f61e0) returned 1 [0102.925] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0102.925] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0102.926] CryptDestroyKey (hKey=0x9f6660) returned 1 [0102.926] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0102.926] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0102.926] CryptDestroyKey (hKey=0x9f63a0) returned 1 [0102.926] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0102.926] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0102.927] CryptDestroyKey (hKey=0x9f6720) returned 1 [0102.927] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0102.927] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0102.927] CryptDestroyKey (hKey=0x9f65a0) returned 1 [0102.927] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0102.932] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0102.932] CryptDestroyKey (hKey=0x9f6620) returned 1 [0102.932] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0102.932] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0102.933] CryptDestroyKey (hKey=0x9f6560) returned 1 [0102.933] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0102.933] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0102.933] CryptDestroyKey (hKey=0x9f6760) returned 1 [0102.933] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0102.933] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0111.810] CryptDestroyKey (hKey=0x9f6720) returned 1 [0111.810] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0111.810] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0111.810] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0111.810] CryptDestroyKey (hKey=0x9f62e0) returned 1 [0111.810] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0111.810] CryptDestroyKey (hKey=0x9f6660) returned 1 [0111.811] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0111.811] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0111.811] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0111.811] CryptDestroyKey (hKey=0x9f60a0) returned 1 [0111.811] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0111.811] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0111.811] CryptDestroyKey (hKey=0x9f63a0) returned 1 [0111.811] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0111.812] CryptDestroyKey (hKey=0x9f6620) returned 1 [0111.812] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0111.812] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0111.812] CryptDestroyKey (hKey=0x9f6760) returned 1 [0111.812] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0111.812] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0111.812] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0111.813] CryptDestroyKey (hKey=0x9f65a0) returned 1 [0111.813] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0111.813] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0111.813] CryptDestroyKey (hKey=0x9f6060) returned 1 [0111.813] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0111.813] CryptDestroyKey (hKey=0x9f6560) returned 1 [0111.813] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0111.813] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0111.814] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0111.814] CryptDestroyKey (hKey=0x9f6120) returned 1 [0111.814] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0111.814] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0111.814] CryptDestroyKey (hKey=0x9f67e0) returned 1 [0111.814] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0111.814] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0111.815] CryptDestroyKey (hKey=0x9f60e0) returned 1 [0111.815] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0111.815] CryptDestroyKey (hKey=0x9f65e0) returned 1 [0111.815] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0111.815] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0111.815] CryptDestroyKey (hKey=0x9f66a0) returned 1 [0111.815] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0111.815] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0111.816] CryptDestroyKey (hKey=0x9f66e0) returned 1 [0111.816] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0111.816] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0111.816] CryptDestroyKey (hKey=0x9f67a0) returned 1 [0111.816] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 [0111.816] CryptReleaseContext (hProv=0x9e9e10, dwFlags=0x0) returned 1 Thread: id = 5 os_tid = 0x83c Thread: id = 6 os_tid = 0xa78 Thread: id = 7 os_tid = 0x754 Thread: id = 8 os_tid = 0x1a4